February 20, 2019 By David Bisson 2 min read

A new family of malware known as WinPot is using a slot machine-like interface to empty ATMs at targeted financial institutions.

Kaspersky Lab first came across WinPot malware back in March 2018. In their resulting analysis, Kaspersky Lab researchers observed that the creators of the malware had designed its interface to look like a slot machine. They did so by creating a “SPIN” button that empties a cash-out cassette contained within an infected ATM unit when clicked.

Intrigued by the threat, Kaspersky Lab decided to keep an eye on its development. They witnessed the emergence of new samples with some minor modifications; for instance, one newer variant adjusted the time period during which the malware worked, while another came with a changed packer.

Researchers found that WinPot isn’t hard to come by for digital attackers. In fact, they discovered that anyone could purchase the threat for around $1,000 on the dark web. That price makes WinPot slightly cheaper than CutletMaker, another ATM malware that Kaspersky Lab found for sale on underground web marketplaces back in October 2017.

The Growing ATM Malware Threat

WinPot comes at a time when ATM malware isn’t just growing in variety. It also arrives amid the growing variety of attacks involving ATM-based threats. In 2017, Trend Micro disclosed that criminals were using network attacks to target ATMs instead of just physically breaking into them. This tactical shift suggests that criminals are willing to invest more time and effort into conducting their ATM attacks.

In January 2018, Krebs on Security reported that “jackpotting” attacks leveraging ATM malware had hit U.S. banks for the first time. This revelation demonstrates how threat actors are expanding the reach of their ATM attacks. That being said, criminals must still obtain physical access to an ATM unit to perform a jackpotting operation successfully.

How Security Professionals Can Defend Against WinPot Malware

Financial companies can help defend against ATM malware by blocking digital attackers from leveraging USB as a pathway to infect an ATM’s personal computer. Security teams should then broaden this control to cover all IT assets, including mobile devices. At the same time, security professionals should use whitelists to specify what types of software can and can’t run on an ATM.

More from

Change Healthcare discloses $22M ransomware payment

3 min read - UnitedHealth Group CEO Andrew Witty found himself answering questions in front of Congress on May 1 regarding the Change Healthcare ransomware attack that occurred in February. During the hearing, he admitted that his organization paid the attacker's ransomware request. It has been reported that the hacker organization BlackCat, also known as ALPHV, received a payment of $22 million via Bitcoin.Even though they made the ransomware payment, Witty shared that Change Healthcare did not get its data back. This is a…

Phishing kit trends and the top 10 spoofed brands of 2023

4 min read -  The 2024 IBM X-Force Threat Intelligence Index reported that phishing was one of the top initial access vectors observed last year, accounting for 30% of incidents. To carry out their phishing campaigns, attackers often use phishing kits: a collection of tools, resources and scripts that are designed and assembled to ease deployment. Each phishing kit deployment corresponds to a single phishing attack, and a kit could be redeployed many times during a phishing campaign. IBM X-Force has analyzed thousands of…

How I got started: AI security researcher

4 min read - For the enterprise, there’s no escape from deploying AI in some form. Careers focused on AI are proliferating, but one you may not be familiar with is AI security researcher. These AI specialists are cybersecurity professionals who focus on the unique vulnerabilities and threats that arise from the use of AI and machine learning (ML) systems. Their responsibilities vary, but key roles include identifying and analyzing potential security flaws in AI models and developing and testing methods malicious actors could…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today