How simple life was three years ago when we last wrote about ATM malware. Back then, security researchers classified ATM attacks into two broad categories: ones that used skimming hardware devices attached to the outside of card readers, and ones that used various techniques to open ATMs’ cabinets and cash drawers. The skimmers were crude but effective in collecting credit and debit card numbers from customers. The latter methods exploited vulnerabilities created by the ATMs’ outdated operating systems (OS) and their functionality. In one case, some criminals blew up the ATMs themselves, as The Daily Mirror reported. Crude, but certainly effective.

XP Marks the Spot

For many years, almost all of the world’s ATMs ran on Windows XP. Banks have been making upgrades to more modern Windows versions, but there are many places around the world where XP still rules, such as India. Criminals are well-aware of this fact and have targeted their malware accordingly.

ATMs are popular targets because they are less secure than the average home. The internal systems of many ATMs are controlled by a hardware lock that can be opened by using a common key. Once the ATM enclosure has been breached and the malware products installed, the malware typically forces a reboot. Malicious actors count on the fact that ATMs often don’t check for the presence of any external media, making it easier to insert a DVD or USB flash drive to control how the OS operates and force the cash drawer to open.

ATM Malware Changes With the Times

But times are changing. First, ATM malware is becoming more subtle. Because security researchers have thoroughly analyzed several ATM malware families, criminals have started using code obfuscation methods such as software packers and virtual machine and sandbox detectors — something that has been common practice in the general malware world for many years.

Another code obfuscation method is reusing common libraries that are part of the legitimate OS. This is how the ATMii malware operates. ATMii is clever enough to be responsive to the Windows OS version on which it is running.

While physical attacks are still popular, researchers are seeing a rise in more subtle malware infections designed to attack the banking networks themselves. These attacks are more difficult to execute because they require the actor to understand how to access the ATM network from the main bank’s networks, but they remain possible because institutions don’t take extra steps to protect themselves. Many banks still don’t segment their networks, for example. If they do, the attacker relies on a banking insider — either a willing participant or someone whose account was compromised — to help bridge the two.

No Signs of Slowing Down

Network attacks have increased and have received a lot of publicity over the past several years. One of the first was the Carbanak attack, a large-scale advanced persistent threat (APT) that occurred in February 2015 and used spear-phishing emails to compromise banking staffers’ accounts.

Then came two infamous attacks in 2016: The first targeted Taiwanese banks, and the second was the discovery of the Ripper malware. Both of these attacks used a compromised administrator’s password to navigate across the banking networks. Another notable threat was the Cobalt Strike attack, which took mere minutes to compromise banking networks.

What these attacks have shown, as one research report noted, is that “we are now at a point where ATM malware is becoming mainstream.” ATM malware authors are adopting the same techniques and methods that other cyberattackers are using to target the general population.