KoffeyMaker Toolkit Used in Black Box ATM Attacks

In 2017 and 2018, threat actors utilized a toolkit called KoffeyMaker in multiple black box ATM attacks targeting Eastern European financial institutions.

When Kaspersky Lab investigated KoffeyMaker in connection with the attacks, researchers discovered that the devices in the campaign consisted of Windows laptops containing ATM dispenser drivers and a patched KDIAG tool.

Those behind the attacks secretly opened an ATM at each targeted bank, connected the device to the cash dispenser, closed the ATM and walked away with the device still inside the machine.

Returning at a later time, attackers leveraged a USB GPRS modem to gain remote access to the device, run the KDIAG tool and execute a command for the ATM to dispense bank notes before retrieving the laptop — all while another attacker collected the money. Together, they then made their escape with potentially tens of thousands of dollars in tow.

ATM Attacks Aren’t New to Europe

Attacks like those involving KoffeyMaker aren’t new. As reported by Information Security Media Group (ISMG), the number of jackpotting attacks against ATMs in European countries grew by 231 percent in 2017. Of those attacks, the majority were black box campaigns. One of these cases involved the use of Cutlet Maker, ATM malware detected by Kaspersky Lab that is not unlike KoffeyMaker in its design.

Fortunately, law enforcement had some success in arresting criminals during that same span of time. In one of the most noteworthy takedowns, several EU member states and Norway, supported by Europol’s European Cybercrime Centre (EC3) and the Joint Cybercrime Action Taskforce (J-CAT), arrested 27 individuals responsible for conducting black box ATM attacks across Europe.

How to Defend Against Tools Like KoffeyMaker

According to Kaspersky Lab, the only way for banks to defend against black box attacks is to use hardware encryption between an ATM’s computer and dispenser. Organizations should also implement a stronger data security strategy. This plan should include the use of encryption to protect sensitive cloud-based data.

Sources: Kaspersky Lab, ISMG, Kaspersky Lab (1), EC3

David Bisson

Contributing Editor

Vulnerability resolution enhanced by integrations

2 min read - Why speed is of the essence in today's cybersecurity landscape? How are you quickly achieving vulnerability resolution?Identifying vulnerabilities should be part of the daily process within an organization. It's an important piece of maintaining an organization’s security posture. However, the complicated nature of modern technologies — and the pace of change — often make vulnerability management a challenging task.In the past, many organizations had to support manual integration work to get different security systems to ‘talk’ to each other. As…

How I got started: SIEM engineer

2 min read - As careers in cybersecurity become increasingly more specialized, Security Information and Event Management (SIEM) engineers are playing a more prominent role. These professionals are like forensic specialists but are also on the front lines protecting sensitive information from the relentless onslaught of cyber threats. SIEM engineers meticulously monitor, analyze and manage security events and incidents within an organization. They leverage SIEM tools to aggregate and correlate data, enabling them to detect anomalies, identify potential threats and respond swiftly to security…

Tequila OS 2.0: The first forensic Linux distribution in Latin America

3 min read - Incident response teams are stretched thin, and the threats are only intensifying. But new tools are helping bridge the gap for cybersecurity pros in Latin America.IBM Security X-Force Threat Intelligence Index 2023 found that 12% of the security incidents X-force responded to were in Latin America. In comparison, 31% were in the Asia-Pacific, followed by Europe with 28%, North America with 25% and the Middle East with 4%. In the Latin American region, Brazil had 67% of incidents that X-Force…

Cost of a data breach 2023: Geographical breakdowns

4 min read - Data breaches can occur anywhere in the world, but they are historically more common in specific countries. Typically, countries with high internet usage and digital services are more prone to data breaches. To that end, IBM’s Cost of a Data Breach Report 2023 looked at 553 organizations of various sizes across 16 countries and geographic regions, and 17 industries. In the report, the top five costs of a data breach by country or region (measured in USD millions) for 2023…

Security Intelligence

{{title}}

{{title}}

{{title}}

{{title}}

Topics

ATM Attacks Aren’t New to Europe

How to Defend Against Tools Like KoffeyMaker

More from

Vulnerability resolution enhanced by integrations

How I got started: SIEM engineer

Tequila OS 2.0: The first forensic Linux distribution in Latin America

Cost of a data breach 2023: Geographical breakdowns