Security Experts:

Connect with us

Hi, what are you looking for?



ATM Malware Sold on Underground Markets for $5K

A recently discovered piece of malware targeting automated teller machines (ATM) is being sold on underground markets for $5,000, Kaspersky Lab reports.

A recently discovered piece of malware targeting automated teller machines (ATM) is being sold on underground markets for $5,000, Kaspersky Lab reports.

Dubbed CUTLET MAKER, the malware is being sold as part of a kit that also consists of a password generator and a Stimulator, which is an application that can grab information on the status of cash cassettes in a target ATM (such as currency, value, and the amount of notes).

Kaspersky’s security researchers discovered the forum post advertising the malware in May 2017 and say that the offer was initially published on AlphaBay, a darknet marketplace that was taken down over the summer. The post provides information on the required equipment and targeted ATM models, along with tips and tricks for the malware’s operation and part of a detailed manual for the toolkit.

The manual “Wall ATM Read Me.txt” was observed being distributed as a plain text file, but the researchers say that it was written in poor English and with bad text formatting. The text contained slang and grammatical mistakes that pointed to a Russian author, and the malware’s name suggests the same (Russian slang term “Cutlet” means “a bundle of money”), the researchers reveal.

According to Kaspersky, the crimeware kit is a collection of programs possibly written by different authors, but the same protection was used for both CUTLET MAKER and Stimulator. There is also a simple terminal-based application called c0decalc that hasn’t been protected at all.

The researchers also say that the malware’s functionality suggests that two people should be involved in the theft, namely a “drop” and a “drop master”.

“Access to the dispense mechanism of CUTLET MAKER is password protected. Though there could be just one person with the c0decalc application needed to generate a password. Either network or physical access to an ATM is required to enter the code in the application text area and also to interact with the user interface,” the researchers say.

Kaspersky found different versions of the main component, with the first known version apparently submitted to a public multiscanner service on June 22, 2016. 

“This type of malware does not affect bank customers directly, it is intended for the theft of cash from specific vendor ATMs. CUTLET MAKER and Stimulator show how criminals are using legitimate proprietary libraries and a small piece of code to dispense money from an ATM,” Kaspersky notes.

Countermeasures against such malware attacks include default-deny policies and device control, the first of which prevents criminals from running their own code on the ATM’s internal PC. According to Kaspersky, the attackers using this malware might have had physical access to the PC, possibly through USB drives used to install the malware onto the machine. Device control software should prevent the connection of new devices, such as USB sticks.

Related: New ATMii Malware Can Empty ATMs

Related: Malware Allows Remote Administration of ATMs

Written By

Ionut Arghire is an international correspondent for SecurityWeek.

Click to comment

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Join this webinar to learn best practices that organizations can use to improve both their resilience to new threats and their response times to incidents.


Join this live webinar as we explore the potential security threats that can arise when third parties are granted access to a sensitive data or systems.


Expert Insights

Related Content


Zendesk is informing customers about a data breach that started with an SMS phishing campaign targeting the company’s employees.


Satellite TV giant Dish Network confirmed that a recent outage was the result of a cyberattack and admitted that data was stolen.


The release of OpenAI’s ChatGPT in late 2022 has demonstrated the potential of AI for both good and bad.


The changing nature of what we still generally call ransomware will continue through 2023, driven by three primary conditions.

Application Security

PayPal is alerting roughly 35,000 individuals that their accounts have been targeted in a credential stuffing campaign.


No one combatting cybercrime knows everything, but everyone in the battle has some intelligence to contribute to the larger knowledge base.


As it evolves, web3 will contain and increase all the security issues of web2 – and perhaps add a few more.


A recently disclosed vBulletin vulnerability, which had a zero-day status for roughly two days last week, was exploited in a hacker attack targeting the...