A new malware strain targeting ATMs, which was being openly sold on the dark net market, has been discovered.
According to researchers at cyber security firm Kaspersky Lab, the malware dubbed Cutlet Maker consists of three components and enables ATM jackpotting if the attacker is able to gain physical access to the machine.
It points out that a toolset potentially allowing criminals to steal millions was on sale for just $5 000 and came equipped with a step-by-step user guide.
ATMs continue to be lucrative targets for fraudsters, who use various methods to extract maximum profit, says Kaspersky Lab.
“While some rely on physically destructive methods through the use of metal cutting tools, others choose malware infection, enabling them to manipulate cash dispensers from the inside. Although malicious tools for hacking ATMs have been known for many years, the latest discovery shows that malware creators are investing more and more resources into making their ‘products’ available for criminals who are not very familiar with computer science,” the cyber security company notes.
It adds that earlier this year, a Kaspersky Lab partner provided one of the company’s researchers with a previously unknown malicious sample presumably made to infect PCs running inside ATMs.
Researchers were curious to see if this malware or something related to it was available to purchase on underground forums. A subsequent search for the unique artefacts of the malware was successful: an advertising offer describing a strain of ATM malware on a popular dark net spot – AlphaBay – matched the search query and revealed the initial sample belonged to a whole commercial malware-kit created to jackpot ATMs.
A public post by the malware seller, found by researchers, contained not only the description of the malware and instructions on how to get it, but also provided a detailed step-by-step guide on how to use the malware-kit in attacks, with instructions and video tutorials.
According to the research, the malware toolkit consists of three elements: Cutlet Maker software, which serves as the main module responsible for communicating with the ATM’s dispenser; c0decalc program, designed to generate a password in order to run the Cutlet Maker application and protect it from unauthorised use; and a stimulator application, which saves time for criminals by identifying the current status of ATM cash cassettes.
By installing this app, an intruder receives exact information on the currency, value and number of notes in each cassette, so can then choose the one containing the largest amount, instead of blindly withdrawing cash one by one.
To begin the theft, criminals need to gain direct access to an ATM’s insides in order to access the USB port, which is used to upload the malware. If successful, they plug in a USB device which stores the software toolkit. As a first step, criminals install Cutlet Maker. Since it is password protected, they use a c0decalc program, installed on another device such as a laptop or tablet – this is a kind of “copyright” protection installed by authors of Cutlet Maker in order to prevent other criminals from using it for free. After the code is generated, criminals enter it into Cutler Maker’s interface to start the money removal process.
Kaspersky says Cutlet Maker had been on sale since 27 March; however, as researchers discovered, the earliest known sample came on the radars of the security community in June 2016. At that time, it was submitted to a public multi-scanner service from Ukraine, but later submissions from other countries were also made. It is not clear if the malware was used in actual in-the-wild attacks; however, the guidelines that came with the malware kit contained videos which were presented by their authors as real-life proof of the malware’s efficiency.
It is unknown who is behind this malware. Regarding potential sellers of the toolkit, language, grammar and stylistic mistakes point to the fact they are non-native English speakers.
“Cutlet Maker requires almost no advanced knowledge or professional computer skills from the criminal, transforming ATM hacking from a sophisticated offensive cyber operation into yet another illegal way to earn money that is available to practically anyone who has several thousand dollars to purchase the malware,” says Konstantin Zykov, security researcher at Kaspersky Lab.
“This may potentially become a dangerous threat to financial organisations. But what is more important is that while operating, Cutlet Maker interacts with the ATM’s software and hardware, encountering almost no security obstacles at all. This should be changed in order to harden ATM machines.”
Our comments policy does not allow anonymous postings. Read the policy here