Top 5 ATM Malware Families Used By Hackers to Dispense Money from Targeted ATMs

ATM-Based cyber attacks are continually evolving with much more advanced methods and functions, attackers continuously employ the number of sophisticated malware families to trick the ATMs to dispense cash.

The first ATM skimmer malware designed to launch an attack on ATMs was spotted 10 years before. From the time of discovery, it has evolved to include several different families and different actors behind them.

ATM-based malware can cause significant damage to end users; financial institutions, and targeted banks.

“Over the past 10 years, we have seen a steady increase in the number of ATM malware samples discovered. Still, the number of discovered samples is minimal compared to almost any other malware category,” Talos reported.

Based on the functions, ATM-based malware classified into virtual skimmers and cash dispensers. The Skimmers card data, transaction details, and PINs, whereas the Cash-dispensing malware is used by attackers to dispense cash from ATMs.

The generic framework used by ATM developers is CEN/XFS framework, which allows them to compile and run the code regardless of the ATM model or manufacturer.

ATMs are not available over the internet they will communicate to bank through special channels; however, they will be connected to the internal networks for administration & maintenance purposes, certain malware takes advantage of that by compromising the internal network first.

Top ATM Malware Families
Image Credits: Talos

Top 5 ATM Malware Families

Ploutus

Ploutus malware used by several criminals to empty ATMs through an external keyboard attached to the machine or via SMS message.

The malware was observed since November 2016; it is a standard ATM-dispensing malware; attackers use this to empty ATM without a card.

Alice

Alice malware first detected in November 2016; it will simply empty the safe of ATMs. Alice directly connects with CurrencyDispenser1, upon entering correct PIN it opens operator panel which shows the cassettes were money loaded.

Cutlet

The malware sold in underground hacking forums since 2016, it is a self-paced where the threat actors provide manuals, details such as the required equipment, targeted ATMs models, as well as tips and tricks for the malware’s operation.

This type of malware does not affect bank customers directly; it is intended for the theft of cash from specific vendor ATMs.

Tyupkin

The Tyupkin malware is active since 2014, and it targets Eastern European countries. It is a timely malware to be operated on specific periods.

Attackers need to gain physical access to the ATM to infect them with Tyupkin malware, once the machine infected it disables all the network connections, even if the administrators spotted the suspicious activity it is not possible to shut down.

Skimer

It is the first skimmer malware designed to steal bank card numbers and details of the account and owner details stored on the magnetic stripe attached to the real payment terminals so that they can harvest data from every person that swipes their cards.

Scammers place skimmer that includes a camera, over the built-in customer-facing security camera in ATMs and angles them toward ATM PIN pad to record the user’s PIN.

You can follow us on LinkedinTwitterFacebook for daily Cybersecurity updates also you can take the Best Cybersecurity courses online to keep yourself updated.

Other Malwares

Malicious Hackers Steal Money From ATM by Connecting Laptop with ATM Cash Dispenser

Most of the ATM’s Around the World Can be Hacked Under 30 Minutes

ATMJackpot – New Malware Steal Your Money From ATM using ATM Jackpotting Technique

Now Anyone Can Buy New ATM-based Malware In Darkweb and Get All Money From ATM Anonymously

ATM Robber Malware Turns ATM into Slot Machine to Dispense Cash Automatically

Malicious Hackers Selling Malware’s Targeting Bitcoin ATMs in the Dark Web Forums

Malware Called “ATMii” allows Hackers to Dispense all the Cash from the ATM

A Fileless Malware Called “ATMitch” Attack The ATM machines Remotely and Delete The Attack Evidence

Gurubaran

Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Recent Posts

Evasive Panda Attacking Cloud Services To Steal Data Using New Toolkit

The Evasive Panda group deployed a new C# framework named CloudScout to target a Taiwanese…

5 hours ago

Massive Midnight Blizzard Phishing Attack Using Weaponized RDP Files

Researchers warn of ongoing spear-phishing attacks by Russian threat actor Midnight Blizzard targeting individuals in…

6 hours ago

Sophisticated Phishing Attack Targeting Ukraine Military Sectors

The Ukrainian Cyber Emergency Response Team discovered a targeted phishing campaign launched by UAC-0215 against…

6 hours ago

Chinese Hackers Attacking Microsoft Customers With Sophisticated Password Spray Attacks

Researchers have identified a network of compromised devices, CovertNetwork-1658, used by Chinese threat actors to…

6 hours ago

New Windows Zero-Day Vulnerability Let Attackers Steal Credentials From Victim’s Machine

A security researcher discovered a vulnerability in Windows theme files in the previous year, which…

6 hours ago

SYS01 InfoStealer Malware Attacking Meta Business Page To Steal Logins

The ongoing Meta malvertising campaign, active for over a month, employs an evolving strategy to…

6 hours ago