Group IB said has it discovered a hacker group called Cobalt that had attacked ATMs in more than a dozen countries in Europe and Asia, including the U.K. and Russia. The “smash and grab” attacks were coordinated from unknown command centers. They don’t require any physical tampering of the ATMs but the hackers do need someone to be present when the attack happens so they can collect the wads of cash from the ATM.
No banks have been named but ATM manufacturers Diebold Nixdorf and NCR Corp have stated that they are aware of the attacks and are working with banks to add new protections.
Nicholas Billett, head of Diebold Nixdorf’s ATM security, said the hackers have gone to the “next level” by attacking huge numbers of ATMs at the same time: “They know they will be caught fairly quickly, so they stage it in such a way that they can get cash from as many ATMs as they can before they get shut down.”
Several other countries were named as victims in Group IB’s report such as the Netherlands, Spain, Malaysia, and Moldova with more attacks predicted in the future if banks and ATM makers don’t take action.
“Logical attacks on ATMs are expected to become one of the key threats targeting banks: they enable cybercriminals to commit fraud remotely from anywhere globally and attack the whole ATM network without being ‘on the radar’ of security services,” said Dmitry Volkov, Group IB’s head of investigation.
Volkov added that the malware used in these attacks isn’t particularly sophisticated and can be easily acquired on the deep web.
In its last report, EU law enforcement agency Europol warned that remote ATM attacks will “evolve and proliferate.”
Different kinds of ATM attacks aren’t new but have become more prevalent, and include skimmers that have been physically installed on machines to steal info off cards. Earlier this year, a bank in Taiwan suspended withdrawals after more than $2 million was allegedly stolen from ATMs using malware.
This marks a significant move for cybercriminals who are finding new ways to pilfer cash. Stealing credit card numbers is one thing but in February we saw hackers steal a staggering $81 million from the Bangladesh central bank. They targeted vulnerabilities in SWIFT, the global banking industry’s messaging network. And now the financial sector has remote ATM hacking to worry about, too.
