Dubbed as ATMJackpot, the new ATM malware has been identified by information security training researchers at Netskope Threat Research Labs. Initial investigation revealed that the malware originated from Hong Kong while the time stamp binary is identified to be 28th March 2018.
The malware is in its developmental phase yet because, in comparison to other, previously discovered malware, ATMJackpot has limited features. Such as its graphical UI is quite basic and only displays the hostname and information about the service providers, e.g PIN pad, card reader and cash dispenser service providers.
According to Netskope’s post, it is yet unclear how ATMJackpot is deployed or used but its purpose is quite clear, which is to steal money from ATMs.
ATM jackpotting is also called logical attack; it refers to using malware for controlling cash dispensing from an ATM. Usually, malware is delivered to an ATM remotely or through a USB port after compromising the operator network of the ATM.
It’s not reveal whether ATMJackpot’s deployment was the result of manual installation through USB on ATMs or was it downloaded from an infected network. If the former was the case then it wouldn’t have been difficult for the crooks because installing malware on an ATM physically isn’t difficult at all.
Jackpotting is designed to avoid physical break-in into the machine and can be inserted into the ATM through the USB port, information security training experts said. Cybercriminals are quite familiar with the version of Windows used in a majority of ATMs so physically compromising the vault is not an issue for them at all.
The malware starts its malicious operation by registering the “Win” windows class name with a malware activity process and then populates the options available on the system to connect with the XFS manager. A common API is provided by the XFS subsystem to manipulate the machine. A session is then initiated by the malware for registering with the service provider so as to track events.
It also initiates a session with the card reader, PIN pad, and cash dispenser service providers. After tracking events, the malware issues commands and reads data from the PIN pad to dispense cash and eject cards. The malware download has been detected as Gen: Variant.Razy.255528.
ATM jackpotting is becoming a serious and concerning issue for information security training experts. The issue was first noticed in Europe in 2014; soon after it spread to Asian regions. Europol warned in 2017 that attacks on ATMs involving jackpotting technique were on a rise, significantly increasing the scale and scope of the attacks against ATMs.
In January 2018, the US witnessed the first ever jackpotting attack against ATMs. A security alert was issued by the Secret Service and a worldwide operation against the members of the notorious Carbanak group, believed to be involved in attacks on ATMs and stealing over $1.24m, was launched.
Working as a cyber security solutions architect, Alisa focuses on application and network security. Before joining us she held a cyber security researcher positions within a variety of cyber security start-ups. She also experience in different industry domains like finance, healthcare and consumer products.
