Forest Global Training Partners

Cyber Risks · Cisco Talos

10 years of virtual dynamite: A high-level retrospective of ATM malware

Summary: Cisco Talos marked 10 years since Skimer, the first malware built specifically to attack ATMs, and counted more than 30 distinct ATM malware families discovered over that decade. The families split into virtual skimmers that steal card and PIN data and cash dispensers that force ATMs to pay out without a bank card, with Ploutus the most-sampled family, mostly reported in Mexico, and Fastcash attributed to the Lazarus Group and targeting IBM AIX.

What's compelling: Fastcash shows a nation-state actor, Lazarus Group, injecting code into bank payment authorization systems to approve fraudulent ISO8583 transactions, a level of sophistication Talos says is not seen in run-of-the-mill ATM malware. Talos notes the damage to banks and individuals is rarely disclosed but likely reaches millions of dollars a year, concentrated where ATM infrastructure is older and not regularly updated with security software or tamper-proof sensors.

Read the original at Cisco Talos ↗

Topics
Malware
Related