A new family of malware known as WinPot is using a slot machine-like interface to empty ATMs at targeted financial institutions.

Kaspersky Lab first came across WinPot malware back in March 2018. In their resulting analysis, Kaspersky Lab researchers observed that the creators of the malware had designed its interface to look like a slot machine. They did so by creating a “SPIN” button that empties a cash-out cassette contained within an infected ATM unit when clicked.

Intrigued by the threat, Kaspersky Lab decided to keep an eye on its development. They witnessed the emergence of new samples with some minor modifications; for instance, one newer variant adjusted the time period during which the malware worked, while another came with a changed packer.

Researchers found that WinPot isn’t hard to come by for digital attackers. In fact, they discovered that anyone could purchase the threat for around $1,000 on the dark web. That price makes WinPot slightly cheaper than CutletMaker, another ATM malware that Kaspersky Lab found for sale on underground web marketplaces back in October 2017.

The Growing ATM Malware Threat

WinPot comes at a time when ATM malware isn’t just growing in variety. It also arrives amid the growing variety of attacks involving ATM-based threats. In 2017, Trend Micro disclosed that criminals were using network attacks to target ATMs instead of just physically breaking into them. This tactical shift suggests that criminals are willing to invest more time and effort into conducting their ATM attacks.

In January 2018, Krebs on Security reported that “jackpotting” attacks leveraging ATM malware had hit U.S. banks for the first time. This revelation demonstrates how threat actors are expanding the reach of their ATM attacks. That being said, criminals must still obtain physical access to an ATM unit to perform a jackpotting operation successfully.

How Security Professionals Can Defend Against WinPot Malware

Financial companies can help defend against ATM malware by blocking digital attackers from leveraging USB as a pathway to infect an ATM’s personal computer. Security teams should then broaden this control to cover all IT assets, including mobile devices. At the same time, security professionals should use whitelists to specify what types of software can and can’t run on an ATM.

More from

Data Privacy: How the Growing Field of Regulations Impacts Businesses

The proposed rules over artificial intelligence (AI) in the European Union (EU) are a harbinger of things to come. Data privacy laws are becoming more complex and growing in number and relevance. So, businesses that seek to become — and stay — compliant must find a solution that can do more than just respond to current challenges. Take a look at upcoming trends when it comes to data privacy regulations and how to follow them. Today's AI Solutions On April…

Why Zero Trust Works When Everything Else Doesn’t

The zero trust security model is proving to be one of the most effective cybersecurity approaches ever conceived. Zero trust — also called zero trust architecture (ZTA), zero trust network architecture (ZTNA) and perimeter-less security — takes a "default deny" security posture. All people and devices must prove explicit permission to use each network resource each time they use that resource. Using microsegmentation and least privileged access principles, zero trust not only prevents breaches but also stymies lateral movement should a breach…

5 Golden Rules of Threat Hunting

When a breach is uncovered, the operational cadence includes threat detection, quarantine and termination. While all stages can occur within the first hour of discovery, in some cases, that's already too late.Security operations center (SOC) teams monitor and hunt new threats continuously. To ward off the most advanced threats, security teams proactively hunt for ones that evade the dashboards of their security solutions.However, advanced threat actors have learned to blend in with their target's environment, remaining unnoticed for prolonged periods. Based…

Third-Party App Stores Could Be a Red Flag for iOS Security

Even Apple can’t escape change forever. The famously restrictive company will allow third-party app stores for iOS devices, along with allowing users to “sideload” software directly. Spurring the move is the European Union’s (EU) Digital Markets Act (DMA), which looks to ensure open markets by reducing the ability of digital “gatekeepers” to restrict content on devices. While this is good news for app creators and end-users, there is a potential red flag: security. Here’s what the compliance-driven change means for…