As time goes by, ATM attacks are becoming more frequent hackers using increasingly sophisticated and targeted methods to gain access to ATMs. It is also observed that malicious actors mostly use specific malwareto extract money from an ATM.
The history of ATM skimmer malware began ten years ago, when the first malware targeting ATMs was designed. Since then, as expected, it has evolved and includes many different families of malicious software, while different actors are behind them.
So let's see which are the top 5 families of malicious programs that target ATMs
Ploutos
The Ploutus malware, which was first identified in November 2016, allows attackers to empty an ATM using an external keyboard that they attach to the machine or via SMS messages. It is a typical malicious software targeting ATMs, giving hackers the ability to steal money without needing a card.
Alice
Another piece of malware that was detected in November 2016 is Alice. It is directly linked to CurrencyDispenser1 and entering the correct PIN opens the admin panel, which allows attackers to steal money from an ATM's safe.
Cutlet
Cutlet contains a guide that provides manuals, details such as the required equipment, the targeted ATM models, as well as tips and tricks for operating the malicious software, from other malicious actors. This type of malware does not directly affect a bank's customers, as it is intended for stealing cash from specific ATMs.
Tyupkin
Operating in Eastern European countries, the Tyupkin malware was first discovered in 2014. To operate, attackers need to gain physical access to the ATM and infect it with the Tyupkin malware. Once the machine is infected, it disables all network connections, and even if administrators have detected the suspicious activity, it is impossible to stop it.
Skimmer
The Skimer is the first malware designed to steal bank card numbers and account details and holder information, which are stored on the magnetic stripe that connects to payment terminals, so they can collect data from every person who uses their card. Fraudsters place the skimmer, which includes a camera above the built-in security camera that is aimed at the customer at ATMs and thus records the user's PIN.
