How simple life was three years ago when we last wrote about ATM malware. Back then, security researchers classified ATM attacks into two broad categories: ones that used skimming hardware devices attached to the outside of card readers, and ones that used various techniques to open ATMs’ cabinets and cash drawers. The skimmers were crude but effective in collecting credit and debit card numbers from customers. The latter methods exploited vulnerabilities created by the ATMs’ outdated operating systems (OS) and their functionality. In one case, some criminals blew up the ATMs themselves, as The Daily Mirror reported. Crude, but certainly effective.

XP Marks the Spot

For many years, almost all of the world’s ATMs ran on Windows XP. Banks have been making upgrades to more modern Windows versions, but there are many places around the world where XP still rules, such as India. Criminals are well-aware of this fact and have targeted their malware accordingly.

ATMs are popular targets because they are less secure than the average home. The internal systems of many ATMs are controlled by a hardware lock that can be opened by using a common key. Once the ATM enclosure has been breached and the malware products installed, the malware typically forces a reboot. Malicious actors count on the fact that ATMs often don’t check for the presence of any external media, making it easier to insert a DVD or USB flash drive to control how the OS operates and force the cash drawer to open.

ATM Malware Changes With the Times

But times are changing. First, ATM malware is becoming more subtle. Because security researchers have thoroughly analyzed several ATM malware families, criminals have started using code obfuscation methods such as software packers and virtual machine and sandbox detectors — something that has been common practice in the general malware world for many years.

Another code obfuscation method is reusing common libraries that are part of the legitimate OS. This is how the ATMii malware operates. ATMii is clever enough to be responsive to the Windows OS version on which it is running.

While physical attacks are still popular, researchers are seeing a rise in more subtle malware infections designed to attack the banking networks themselves. These attacks are more difficult to execute because they require the actor to understand how to access the ATM network from the main bank’s networks, but they remain possible because institutions don’t take extra steps to protect themselves. Many banks still don’t segment their networks, for example. If they do, the attacker relies on a banking insider — either a willing participant or someone whose account was compromised — to help bridge the two.

No Signs of Slowing Down

Network attacks have increased and have received a lot of publicity over the past several years. One of the first was the Carbanak attack, a large-scale advanced persistent threat (APT) that occurred in February 2015 and used spear-phishing emails to compromise banking staffers’ accounts.

Then came two infamous attacks in 2016: The first targeted Taiwanese banks, and the second was the discovery of the Ripper malware. Both of these attacks used a compromised administrator’s password to navigate across the banking networks. Another notable threat was the Cobalt Strike attack, which took mere minutes to compromise banking networks.

What these attacks have shown, as one research report noted, is that “we are now at a point where ATM malware is becoming mainstream.” ATM malware authors are adopting the same techniques and methods that other cyberattackers are using to target the general population.

More from Banking & Finance

PixPirate: The Brazilian financial malware you can’t see

10 min read - Malicious software always aims to stay hidden, making itself invisible so the victims can’t detect it. The constantly mutating PixPirate malware has taken that strategy to a new extreme. PixPirate is a sophisticated financial remote access trojan (RAT) malware that heavily utilizes anti-research techniques. This malware’s infection vector is based on two malicious apps: a downloader and a droppee. Operating together, these two apps communicate with each other to execute the fraud. So far, IBM Trusteer researchers have observed this…

New Fakext malware targets Latin American banks

6 min read - This article was made possible thanks to contributions from Itzhak Chimino, Michael Gal and Liran Tiebloom. Browser extensions have become integral to our online experience. From productivity tools to entertainment add-ons, these small software modules offer customized features to suit individual preferences. Unfortunately, extensions can prove useful to malicious actors as well. Capitalizing on the favorable characteristics of an add-on, an attacker can leverage attributes like persistence, seamless installation, elevated privileges and unencrypted data exposure to distribute and operate banking…

DORA and your quantum-safe cryptography migration

5 min read - Quantum computing is a new paradigm with the potential to tackle problems that classical computers cannot solve today. Unfortunately, this also introduces threats to the digital economy and particularly the financial sector.The Digital Operational Resilience Act (DORA) is a regulatory framework that introduces uniform requirements across the European Union (EU) to achieve a "high level of operational resilience" in the financial services sector. Entities covered by DORA — such as credit institutions, payment institutions, insurance undertakings, information and communication technology…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today