Friday, March 29, 2024

Top 5 ATM Malware Families Used By Hackers to Dispense Money from Targeted ATMs

ATM-Based cyber attacks are continually evolving with much more advanced methods and functions, attackers continuously employ the number of sophisticated malware families to trick the ATMs to dispense cash.

The first ATM skimmer malware designed to launch an attack on ATMs was spotted 10 years before. From the time of discovery, it has evolved to include several different families and different actors behind them.

ATM-based malware can cause significant damage to end users; financial institutions, and targeted banks.

“Over the past 10 years, we have seen a steady increase in the number of ATM malware samples discovered. Still, the number of discovered samples is minimal compared to almost any other malware category,” Talos reported.

Based on the functions, ATM-based malware classified into virtual skimmers and cash dispensers. The Skimmers card data, transaction details, and PINs, whereas the Cash-dispensing malware is used by attackers to dispense cash from ATMs.

The generic framework used by ATM developers is CEN/XFS framework, which allows them to compile and run the code regardless of the ATM model or manufacturer.

ATMs are not available over the internet they will communicate to bank through special channels; however, they will be connected to the internal networks for administration & maintenance purposes, certain malware takes advantage of that by compromising the internal network first.

Top ATM Malware Families
Image Credits: Talos

Top 5 ATM Malware Families

Ploutus

Ploutus malware used by several criminals to empty ATMs through an external keyboard attached to the machine or via SMS message.

The malware was observed since November 2016; it is a standard ATM-dispensing malware; attackers use this to empty ATM without a card.

Alice

Alice malware first detected in November 2016; it will simply empty the safe of ATMs. Alice directly connects with CurrencyDispenser1, upon entering correct PIN it opens operator panel which shows the cassettes were money loaded.

Cutlet

The malware sold in underground hacking forums since 2016, it is a self-paced where the threat actors provide manuals, details such as the required equipment, targeted ATMs models, as well as tips and tricks for the malware’s operation.

This type of malware does not affect bank customers directly; it is intended for the theft of cash from specific vendor ATMs.

Tyupkin

The Tyupkin malware is active since 2014, and it targets Eastern European countries. It is a timely malware to be operated on specific periods.

Attackers need to gain physical access to the ATM to infect them with Tyupkin malware, once the machine infected it disables all the network connections, even if the administrators spotted the suspicious activity it is not possible to shut down.

Skimer

It is the first skimmer malware designed to steal bank card numbers and details of the account and owner details stored on the magnetic stripe attached to the real payment terminals so that they can harvest data from every person that swipes their cards.

Scammers place skimmer that includes a camera, over the built-in customer-facing security camera in ATMs and angles them toward ATM PIN pad to record the user’s PIN.

You can follow us on LinkedinTwitterFacebook for daily Cybersecurity updates also you can take the Best Cybersecurity courses online to keep yourself updated.

Other Malwares

Malicious Hackers Steal Money From ATM by Connecting Laptop with ATM Cash Dispenser

Most of the ATM’s Around the World Can be Hacked Under 30 Minutes

ATMJackpot – New Malware Steal Your Money From ATM using ATM Jackpotting Technique

Now Anyone Can Buy New ATM-based Malware In Darkweb and Get All Money From ATM Anonymously

ATM Robber Malware Turns ATM into Slot Machine to Dispense Cash Automatically

Malicious Hackers Selling Malware’s Targeting Bitcoin ATMs in the Dark Web Forums

Malware Called “ATMii” allows Hackers to Dispense all the Cash from the ATM

A Fileless Malware Called “ATMitch” Attack The ATM machines Remotely and Delete The Attack Evidence

Website

Latest articles

Beware Of Weaponized Air Force invitation PDF Targeting Indian Defense And Energy Sectors

EclecticIQ cybersecurity researchers have uncovered a cyberespionage operation dubbed "Operation FlightNight" targeting Indian government...

WarzoneRAT Returns Post FBI Seizure: Utilizing LNK & HTA File

The notorious WarzoneRAT malware has made a comeback, despite the FBI's recent efforts to...

Google Revealed Kernel Address Sanitizer To Harden Android Firmware And Beyond

Android devices are popular among hackers due to the platform’s extensive acceptance and open-source...

Compromised SaaS Supply Chain Apps: 97% of Organizations at Risk of Cyber Attacks

Businesses increasingly rely on Software as a Service (SaaS) applications to drive efficiency, innovation,...

IT and security Leaders Feel Ill-Equipped to Handle Emerging Threats: New Survey

A comprehensive survey conducted by Keeper Security, in partnership with TrendCandy Research, has shed...

How to Analyse .NET Malware? – Reverse Engineering Snake Keylogger

Utilizing sandbox analysis for behavioral, network, and process examination provides a foundation for reverse...

GoPlus’s Latest Report Highlights How Blockchain Communities Are Leveraging Critical API Security Data To Mitigate Web3 Threats

GoPlus Labs, the leading Web3 security infrastructure provider, has unveiled a groundbreaking report highlighting...
Guru baran
Guru baranhttps://gbhackers.com
Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Mitigating Vulnerability Types & 0-day Threats

Mitigating Vulnerability & 0-day Threats

Alert Fatigue that helps no one as security teams need to triage 100s of vulnerabilities.

  • The problem of vulnerability fatigue today
  • Difference between CVSS-specific vulnerability vs risk-based vulnerability
  • Evaluating vulnerabilities based on the business impact/risk
  • Automation to reduce alert fatigue and enhance security posture significantly

Related Articles