Taiwanese law enforcement agencies are investigating malware-based attacks against ATMs of a national bank that resulted in a $2 million theft
Law enforcement in Taiwan is investigating attacks against ATMs of a major national bank, Taiwan’s First Bank. Crooks reportedly used malware to withdraw more than $2 million from dozens of ATMs in the country, the first time that cybercriminals used this technique in Taiwan.
Taiwanese authorities suspect the involvement of two Russian nationals that were wearing masks while cashing out dozens of ATMs in the last weekend. The two suspects have reportedly left the country after stealing T$70m ($2.2m). The cybercriminals operated while the Taiwanese capital of Taipei was battered by a typhoon.
According to video footage recorded by security cameras, the hackers didn’t use skimmers to steal payment card data; they likely used malware to control the ATM.
The images show the crooks using a “connected device,” likely a smartphone, to instruct the ATM to release the cash.
The targeted ATMs are produced by Wincor Nixdorf. The company admitted that some of its ATMs in Taiwan were hacked as part of a “premeditated attack.”
“Attacks follow a similar pattern, irrespective of their make or brand, and we as well as the banks are aware of them,” a Wincor official in Germany told Reuters by email. “The details of the attack are being examined by the police, banks as well as experts from Wincor Nixdorf. To support the local teams we have sent security experts,” according to a Wincor statement reported by the Reuters Agency.
Investigators have discovered three different strains of malware on the hacked ATMs. Of course, the banks in the country are starting to improve cybersecurity of their machines in order to prevent similar attacks.
Malware-based attacks against ATMs are not a novelty; an article published on the Infosec Institute detailed the recent attacks against ATMs worldwide.
Attacks based on various ATM malware, including Suceful, GreenDispenser and Skimer are reported in the article.
All these malware implement the ATM jackpotting technique presented by Barnaby Jack at Black Hat USA 2010.
In November 2014, a gang of Romanian and Moldovan criminals stole nearly £1.6m in raids on ATMs in the UK. The group used malware to compromise more than 50 ATMs.
In the same period, experts from Kaspersky Lab observed several attacks on ATMs which were infected by malware dubbed Tyupkin. Tyupkin is one of the most popular malicious codes used by criminals to hack ATMs and force them to release cash on demand. Experts at Kaspersky Lab collected evidence that Tyupkin infected at least 50 ATMs, mainly in Eastern Europe.
In May 2013, security experts spotted another ATM Trojan dubbed Padpin; meanwhile in October 2013, malware researchers isolated samples of another malware dubbed Ploutus that was circulated to compromise banking machines and steal cash from them.
(Security Affairs – hacking ATMs, malware)
Share On
