Recent Thai ATM Robbery with Potentially Sophisticated Malware

An advanced malware program has been found which possibly one hackers' gang employed for robbing ATMs (automatic teller machines) in Thailand off over $350,000. The malicious program named Ripper was put for a test by VirusTotal after being uploaded from certain IP address within the country shortly after which Thai media reported about computer attackers employing malware for pilfering 12.29m Baht out of 21 ATMs in Thailand.

According to police, a few of the infected ATMs produced some 40,000 Baht on every instance of drawing cash. There's one PE compile dating to July and associating with the ATM breach of August.

Daniel Regalado, Senior Malware Researcher states that Security firm FireEye on August 23, 2016, spotted one relatively fresh ATM malware which employed certain fascinating techniques. Theregister.co.uk posted this, August 30, 2016.

When Ripper attacks, it turns off area network interface of the ATM like it occurred during the latest Thailand instance. Although the assault got publicly announced recently it was one month later of the compilation of the malware program, July 10.

To work, Ripper, after getting planted onto an ATM, hangs around till attackers push in a card that contains one chip specially programmed. The system is for authenticating the card and previously other ATM malicious programs applied it too. After authentication the attacker would instruct the malware to dispense a maximum of 40 currency notes out of the machine's cash containers.

When thugs plan to steal from ATMs, they push in one customized EMV card inside the machines that infects them and makes ready for plundering.

Regalado within one technical analysis indicates that there are many ways for deploying an ATM malware. One is when people inside the bank deploy it while doing the job of a servicing man or technician for the ATMs. Another involves deploying malware via USB ports or CD-ROM of the machines obtainable after removing covers over them using sophisticated service keys that anyone can buy over the Net. This particular technique is for solely those ATMs which are installed outside, even within places that are not secured, and which appears as being the Thailand instance.

» SPAMfighter News - 9/2/2016