Even the affected banks could not find any trace of malware on its ATMs or backend network or any sign of an intrusion.
The log files included the two process strings containing the phrases: “Take the Money Bitch!” and “Dispense Success.”
This small clue was enough for the researchers from the Russian security firm Kaspersky, who have been investigating the ATM heists, to find malware samples related to the ATM attack.
According to the researchers, the attacks against banks were carried out using a Fileless malware that resides solely in the memory (RAM) of the infected ATMs, rather than on the hard drive.
Now during the Kaspersky Security Analyst Summit in St. Maarten on Monday, security researchers Sergey Golovanov and Igor Soumenkov delved into the ATM hacks that targeted two Russian banks, describing how the attackers used the fileless malware to gain a strong foothold into bank’s systems and cash out, ThreatPost reports.
Mysterious ATM Hack Uncovered by Researchers
Dubbed ATMitch, the malware — previously spotted in the wild in Kazakhstan and Russia — is remotely installed and executed on ATMs via its remote administration module, which gives hackers the ability to form an SSH tunnel, deploy the malware, and then sending the command to the ATM to dispense cash.
Since Fileless malware uses the existing legitimate tools on a machine so that no malware gets installed on the system, the ATM treats the malicious code as legitimate software, allowing remote operators to send the command at the time when their associates are present on the infected ATM to pick up the money.
This ATM theft takes just a few seconds to be completed without the operator physically going near the machine. Once the ATM has been emptied, the operator ‘signs off,’ leaving a very little trace, if any, of the malware.
A Very Precise Form of Physical Penetration
Since opening the ATM’s panel directly could also trigger an alarm, attackers switched to a very precise form of physical penetration: Drilling a golf-ball sized hole in ATM’s front panel to gain direct access to the cash dispenser panel using a serial distributed control (SDC RS485 standard) wire.
This method was revealed when Golovanov and Soumenkov were able to reverse engineer the ATM attack after police arrested a man dressed as a construction worker while he was drilling into an ATM to inject malicious commands in the middle of the day to trigger the machine’s cash dispenser.
The suspect was arrested with a laptop, cables, and a small box.
In fact, this technique also affects ATMs around the world, leaving them vulnerable to having their cash drawn out in a matter of minutes.
Currently, the group or country behind these ATM hacks is unknown, but coding present in the attack contains references to the Russian language, and the tactics, techniques, and procedures bear a resemblance to those used by bank-robbing gangs Carbanak and GCMAN.
Fileless malware attacks are becoming more frequent.
