International ATM Malware Gang Dismantled

Romanian law enforcement authorities assisted by Europol this week arrested eight individuals suspected of being part of an international group that used malware to steal money from ATMs.

Europol said the attackers used a piece of malware called Tyupkin (Padpin) to conduct what are known as “jackpotting” attacks. Tyupkin was analyzed in detail by Kaspersky Lab in 2014 after the threat was discovered on more than 50 machines in Eastern Europe. The malware allows its operators to withdraw money from ATMs without payment cards.

According to Romania’s Directorate for Investigating Organized Crime and Terrorism (DIICOT), the arrested individuals are suspected of establishment of an organized criminal group, illegal access to computer systems, computer fraud, disruption of information systems, alteration of computer data integrity, illegal operations with devices and software, and destruction of property.

The suspects, residents of Romania and the Republic of Moldova, are believed to have caused damage estimated at roughly €200,000 ($217,000).

Between December 2014 and October 2015, the group, led by Moldovan national Solozabal Cuartero Rodion and Romanian national Mihaila Sorin, targeted ATMs in Romania and various other European countries, including Hungary, the Czech Republic, Spain and Russia, Romanian prosecutors said.

In the first phase of the attack, which generally took place on weekdays, members of the group scouted ATMs, specifically targeting cash machines that were accessible 24 hours a day and positioned in a way that allowed easy manipulation. Authorities said the gang primarily targeted ATMs developed by NCR.

Once they found an ATM they could target, the crooks tampered with the machine in an effort to gain access to its CD-ROM drive, which they could use to plant the malware. Before the actual attack, the group also verified the existence of ATM alarm systems, which they deactivated using duct tape, and ensured that the CD-ROM drive was working properly.

The attacks took place on weekends since the malware was designed to work properly only during the weekend. Once Tyupkin was planted on an ATM, members of the group could send commands to the malware via the PIN pad and instruct it to dispense cash without the need to use a payment card.

According to DIICOT, the crooks didn’t empty the cash machines in one go and instead made multiple withdrawals of roughly $1,000 each. Once they emptied an ATM, the malware would automatically remove itself from the system.

Since malware and logical attacks targeting ATMs are a serious problem, Europol and the European ATM Security Team (EAST) published guidelines last year to help members of the industry and law enforcement counter the threat.

In September, security firms reported finding two new ATM malware families. One of them, dubbed GreenDispense, is similar to Tyupkin as it allows attackers to empty a machine’s cash vault using the PIN pad. The other threat, dubbed Suceful, can be used to physically steal payment cards inserted by cardholders into ATMs.