Security Experts:

Connect with us

Hi, what are you looking for?


Tracking & Law Enforcement

International ATM Malware Gang Dismantled

Romanian law enforcement authorities assisted by Europol this week arrested eight individuals suspected of being part of an international group that used malware to steal money from ATMs.

Romanian law enforcement authorities assisted by Europol this week arrested eight individuals suspected of being part of an international group that used malware to steal money from ATMs.

Europol said the attackers used a piece of malware called Tyupkin (Padpin) to conduct what are known as “jackpotting” attacks. Tyupkin was analyzed in detail by Kaspersky Lab in 2014 after the threat was discovered on more than 50 machines in Eastern Europe. The malware allows its operators to withdraw money from ATMs without payment cards.

According to Romania’s Directorate for Investigating Organized Crime and Terrorism (DIICOT), the arrested individuals are suspected of establishment of an organized criminal group, illegal access to computer systems, computer fraud, disruption of information systems, alteration of computer data integrity, illegal operations with devices and software, and destruction of property.

The suspects, residents of Romania and the Republic of Moldova, are believed to have caused damage estimated at roughly €200,000 ($217,000).

Between December 2014 and October 2015, the group, led by Moldovan national Solozabal Cuartero Rodion and Romanian national Mihaila Sorin, targeted ATMs in Romania and various other European countries, including Hungary, the Czech Republic, Spain and Russia, Romanian prosecutors said.

In the first phase of the attack, which generally took place on weekdays, members of the group scouted ATMs, specifically targeting cash machines that were accessible 24 hours a day and positioned in a way that allowed easy manipulation. Authorities said the gang primarily targeted ATMs developed by NCR.

Once they found an ATM they could target, the crooks tampered with the machine in an effort to gain access to its CD-ROM drive, which they could use to plant the malware. Before the actual attack, the group also verified the existence of ATM alarm systems, which they deactivated using duct tape, and ensured that the CD-ROM drive was working properly.

The attacks took place on weekends since the malware was designed to work properly only during the weekend. Once Tyupkin was planted on an ATM, members of the group could send commands to the malware via the PIN pad and instruct it to dispense cash without the need to use a payment card.

According to DIICOT, the crooks didn’t empty the cash machines in one go and instead made multiple withdrawals of roughly $1,000 each. Once they emptied an ATM, the malware would automatically remove itself from the system.

Since malware and logical attacks targeting ATMs are a serious problem, Europol and the European ATM Security Team (EAST) published guidelines last year to help members of the industry and law enforcement counter the threat.

In September, security firms reported finding two new ATM malware families. One of them, dubbed GreenDispense, is similar to Tyupkin as it allows attackers to empty a machine’s cash vault using the PIN pad. The other threat, dubbed Suceful, can be used to physically steal payment cards inserted by cardholders into ATMs.

Written By

Eduard Kovacs (@EduardKovacs) is a contributing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.

Click to comment

Expert Insights

Related Content


The FBI dismantled the network of the prolific Hive ransomware gang and seized infrastructure in Los Angeles that was used for the operation.


US government reminds the public that a reward of up to $10 million is offered for information on cybercriminals, including members of the Hive...


The Hive ransomware website has been seized as part of an operation that involved law enforcement in 10 countries.


The owner of China-based cryptocurrency exchange Bitzlato was arrested in Miami along with five associates in Europe


Google Project Zero has disclosed the details of three Samsung phone vulnerabilities that have been exploited by a spyware vendor since when they still...


A hacker who reportedly posed as the CEO of a financial institution claims to have obtained access to the more than 80,000-member database of...

Application Security

Virtualization technology giant Citrix on Tuesday scrambled out an emergency patch to cover a zero-day flaw in its networking product line and warned that...


A top U.S. intelligence official on Thursday urged Congress to renew sweeping powers granted to American spy agencies to surveil and examine communications, saying...