How simple life was three years ago when we last wrote about ATM malware. Back then, security researchers classified ATM attacks into two broad categories: ones that used skimming hardware devices attached to the outside of card readers, and ones that used various techniques to open ATMs’ cabinets and cash drawers. The skimmers were crude but effective in collecting credit and debit card numbers from customers. The latter methods exploited vulnerabilities created by the ATMs’ outdated operating systems (OS) and their functionality. In one case, some criminals blew up the ATMs themselves, as The Daily Mirror reported. Crude, but certainly effective.

XP Marks the Spot

For many years, almost all of the world’s ATMs ran on Windows XP. Banks have been making upgrades to more modern Windows versions, but there are many places around the world where XP still rules, such as India. Criminals are well-aware of this fact and have targeted their malware accordingly.

ATMs are popular targets because they are less secure than the average home. The internal systems of many ATMs are controlled by a hardware lock that can be opened by using a common key. Once the ATM enclosure has been breached and the malware products installed, the malware typically forces a reboot. Malicious actors count on the fact that ATMs often don’t check for the presence of any external media, making it easier to insert a DVD or USB flash drive to control how the OS operates and force the cash drawer to open.

ATM Malware Changes With the Times

But times are changing. First, ATM malware is becoming more subtle. Because security researchers have thoroughly analyzed several ATM malware families, criminals have started using code obfuscation methods such as software packers and virtual machine and sandbox detectors — something that has been common practice in the general malware world for many years.

Another code obfuscation method is reusing common libraries that are part of the legitimate OS. This is how the ATMii malware operates. ATMii is clever enough to be responsive to the Windows OS version on which it is running.

While physical attacks are still popular, researchers are seeing a rise in more subtle malware infections designed to attack the banking networks themselves. These attacks are more difficult to execute because they require the actor to understand how to access the ATM network from the main bank’s networks, but they remain possible because institutions don’t take extra steps to protect themselves. Many banks still don’t segment their networks, for example. If they do, the attacker relies on a banking insider — either a willing participant or someone whose account was compromised — to help bridge the two.

No Signs of Slowing Down

Network attacks have increased and have received a lot of publicity over the past several years. One of the first was the Carbanak attack, a large-scale advanced persistent threat (APT) that occurred in February 2015 and used spear-phishing emails to compromise banking staffers’ accounts.

Then came two infamous attacks in 2016: The first targeted Taiwanese banks, and the second was the discovery of the Ripper malware. Both of these attacks used a compromised administrator’s password to navigate across the banking networks. Another notable threat was the Cobalt Strike attack, which took mere minutes to compromise banking networks.

What these attacks have shown, as one research report noted, is that “we are now at a point where ATM malware is becoming mainstream.” ATM malware authors are adopting the same techniques and methods that other cyberattackers are using to target the general population.

More from Banking & Finance

How to Spot a Nefarious Cryptocurrency Platform

Do you ever wonder if your cryptocurrency platform cashes in ransomware payments? Maybe not, but it might be worth investigating. Bitcoin-associated ransomware continues to plague companies, government agencies and individuals with no signs of letting up. And if your platform gets sanctioned, you may instantly lose access to all your funds. What exchanges or platforms do criminals use to cash out or launder ransomware payments? And what implications does this have for people who use exchanges legitimately? Blacklisted Exchanges and Mixers…

Kronos Malware Reemerges with Increased Functionality

The Evolution of Kronos Malware The Kronos malware is believed to have originated from the leaked source code of the Zeus malware, which was sold on the Russian underground in 2011. Kronos continued to evolve and a new variant of Kronos emerged in 2014 and was reportedly sold on the darknet for approximately $7,000. Kronos is typically used to download other malware and has historically been used by threat actors to deliver different types of malware to victims. After remaining…

Why Cybersecurity Risk Assessment Matters in the Banking Industry

When customers put money in a bank, they need to trust it will stay there. Because of the high stakes involved for the customer, such as financial loss, and how long it takes to resolve fraud and potential identity theft, customers are sensitive to the security of the bank as well as fraud prevention measures. Banks that experience high volumes of fraud are likely to lose customers and revenue. The key is to protect customers and their accounts before problems…

Cost of a Data Breach: Banking and Finance

The importance of cybersecurity has touched almost every industry. Beyond that, robust cybersecurity is table stakes for several sectors, particularly health care and the banking and finance industry. Not only is financial data at risk, but so is customer trust. In banking and finance, trust means everything. Yet, consumers are hesitant to share their confidential data. A recent McKinsey survey revealed that no industry achieved a trust rating of 50% for data protection. Here’s the most sobering stat: 87% of…