Cybercriminals have their sights firmly set on ATMs, according to one Russian security firm which is warning about malware attacks that can strip huge amounts of money from multiple cashpoints.
According to security outfit Group IB, criminals can hack the central systems of banks and then trigger multiple cash machines to spew out money simultaneously, without having to physically access or manipulate said machines.
Of course, they need to ensure people are on hand at the various ATMs to scoop up the cash – and such an attack won’t last long on the radar of the affected bank, naturally.
But long enough for the average successful attack to milk around $400,000 (about £320,000) from the financial institution which has been targeted, or so Group IB estimates.
According to a report by the BBC, banks in the UK have been hit by such attacks, along with other European nations including Armenia, Estonia, the Netherlands, Poland, Russia, and Spain.
Malaysia was also mentioned outside of Europe, and apparently in global terms, 14 nations have been affected. As for exactly which banks have fallen victim to such a scam, they weren’t named.
- Many of the best PCs come equipped with virus protection
Hitting the jackpot
The sting is known as 'touchless jackpotting' and uses malware which spreads itself throughout the bank’s internal networks – systems can be infected using tools that are “widely available in public sources”, according to the security firm (namely the dark web).
And attacks can be pulled off frighteningly quickly – the fastest time taken to gain “total control” over a banking network was just 10 minutes.
Dmitry Volkov, head of the Investigation Department at Group IB, commented: “Logical attacks on ATMs are expected to become one of the key threats targeting banks: they enable cybercriminals to commit fraud remotely from anywhere globally and attack the whole ATM network without being 'on the radar' of security services.
“That said, this type of attack does not require development of expensive advanced software – a significant amount of the tools used are widely available on the deep web. Every bank is under threat of logical attacks on ATMs and should be protected accordingly.”
