February 20, 2019 By David Bisson 2 min read

A new family of malware known as WinPot is using a slot machine-like interface to empty ATMs at targeted financial institutions.

Kaspersky Lab first came across WinPot malware back in March 2018. In their resulting analysis, Kaspersky Lab researchers observed that the creators of the malware had designed its interface to look like a slot machine. They did so by creating a “SPIN” button that empties a cash-out cassette contained within an infected ATM unit when clicked.

Intrigued by the threat, Kaspersky Lab decided to keep an eye on its development. They witnessed the emergence of new samples with some minor modifications; for instance, one newer variant adjusted the time period during which the malware worked, while another came with a changed packer.

Researchers found that WinPot isn’t hard to come by for digital attackers. In fact, they discovered that anyone could purchase the threat for around $1,000 on the dark web. That price makes WinPot slightly cheaper than CutletMaker, another ATM malware that Kaspersky Lab found for sale on underground web marketplaces back in October 2017.

The Growing ATM Malware Threat

WinPot comes at a time when ATM malware isn’t just growing in variety. It also arrives amid the growing variety of attacks involving ATM-based threats. In 2017, Trend Micro disclosed that criminals were using network attacks to target ATMs instead of just physically breaking into them. This tactical shift suggests that criminals are willing to invest more time and effort into conducting their ATM attacks.

In January 2018, Krebs on Security reported that “jackpotting” attacks leveraging ATM malware had hit U.S. banks for the first time. This revelation demonstrates how threat actors are expanding the reach of their ATM attacks. That being said, criminals must still obtain physical access to an ATM unit to perform a jackpotting operation successfully.

How Security Professionals Can Defend Against WinPot Malware

Financial companies can help defend against ATM malware by blocking digital attackers from leveraging USB as a pathway to infect an ATM’s personal computer. Security teams should then broaden this control to cover all IT assets, including mobile devices. At the same time, security professionals should use whitelists to specify what types of software can and can’t run on an ATM.

More from

Cyberattack on American Water: A warning to critical infrastructure

3 min read - American Water, the largest publicly traded United States water and wastewater utility, recently experienced a cybersecurity incident that forced the company to disconnect key systems, including its customer billing platform. As the company’s investigation continues, there are growing concerns about the vulnerabilities that persist in the water sector, which has increasingly become a target for cyberattacks. The breach is a stark reminder of the critical infrastructure risks that have long plagued the industry. While the water utility has confirmed that…

What’s behind unchecked CVE proliferation, and what to do about it

4 min read - The volume of Common Vulnerabilities and Exposures (CVEs) has reached staggering levels, placing immense pressure on organizations' cyber defenses. According to SecurityScorecard, there were 29,000 vulnerabilities recorded in 2023, and by mid-2024, nearly 27,500 had already been identified.Meanwhile, Coalition's 2024 Cyber Threat Index forecasts that the total number of CVEs for 2024 will hit 34,888—a 25% increase compared to the previous year. This upward trend presents a significant challenge for organizations trying to manage vulnerabilities and mitigate potential exploits.What’s behind…

Quishing: A growing threat hiding in plain sight

4 min read - Our mobile devices go everywhere we go, and we can use them for almost anything. For businesses, the accessibility of mobile devices has also made it easier to create more interactive ways to introduce new products and services while improving user experiences across different industries. Quick-response (QR) codes are a good example of this in action and help mobile devices quickly navigate to web pages or install new software by simply scanning an image.However, legitimate organizations aren’t the only ones…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today