Kaspersky Lab researchers have discovered a malware targeting ATMs, which was being openly sold on the DarkNet market. Cutlet Maker consists of three components and enables ATM jackpotting if the attacker is able to gain physical access to the machine. A toolset potentially allowing criminals to steal millions was on sale for just £3,788 and came equipped with a step-by-step user guide.

ATMs continue to be lucrative targets for fraudsters, who use various methods to extract maximum profit. While some rely on physically destructive methods through the use of metal cutting tools, others choose malware infection, enabling them to manipulate cash dispensers from the inside. Although malicious tools for hacking ATMs have been known for many years, the latest discovery shows that malware creators are investing more and more resources into making their “products” available for criminals who are not very familiar with computer science.

Earlier this year, a Kaspersky Lab partner provided one of our researchers with a previously unknown malicious sample presumably made to infect PCs running inside ATMs. Researchers were curious to see if this malware or something related to it was available to purchase on underground forums. A subsequent search for the unique artifacts of the malware was successful: an advertising offer describing a strain of ATM malware on a popular DarkNet spot – AlphaBay – matched the search query and revealed that the initial sample belonged to a whole commercial malware-kit created to jackpot ATMs. A public post by the malware seller, found by researchers, contained not only the description of the malware and instructions on how to get it, but also provided a detailed step-by-step guide on how to use the malware-kit in attacks, with instructions and video tutorials.

According to the research, the malware toolkit consists of three elements:

• Cutlet Maker software, which serves as the main module responsible for communicating with the ATM’s dispenser.
• c0decalcprogram, designed to generate a password in order to run the Cutlet Maker application and protect it from unauthorised use.
• Stimulator application, which saves time for criminals by identifying the current status of ATM cash cassettes. By installing this app, an intruder receives exact information on the currency, value and number of notes in each cassette, so can then choose the one containing the largest amount, instead of blindly withdrawing cash one by one.

To begin the theft, criminals need to gain direct access to an ATM’s insides in order to access the USB port, which is used to upload the malware. If successful, they plug in a USB device which stores the software toolkit. As a first step criminals install Cutlet Maker. Since it is password protected they use a c0decalc program, installed on another device such as a laptop or tablet – this is a kind of “copyright” protection installed by authors of Cutlet Maker in order to prevent other criminals from using it for free. After the code is generated, criminals enter it into Cutler Maker’s interface to start the money removal process.

Cutlet Maker had been on sale since 27 March 2017, however as researchers discovered, the earliest known sample came on the radars of the security community in June 2016. At that time it was submitted to a public multi-scanner service from Ukraine, but later submissions from other countries were also made. It is not clear if the malware was used in actual in the wild attacks, however the guidelines that came with the malware kit contained videos which were presented by their authors as real life proof of the malware’s efficiency.

It is unknown who is behind this malware. Regarding potential sellers of the toolkit, language, grammar and stylistic mistakes point to the fact they are non-native English speakers.

“Cutlet Maker requires almost no advanced knowledge or professional computer skills from the criminal, transforming ATM hacking from a sophisticated offensive cyber operation into yet another illegal way to earn money that is available to practically anyone who has several thousand dollars to purchase the malware. This may potentially become a dangerous threat to financial organisations. But what is more important is that while operating, Cutlet Maker interacts with the ATMs software and hardware, encountering almost no security obstacles at all. This should be changed in order to harden ATM machines,” says Konstantin Zykov, security researcher at Kaspersky Lab.

In order to protect ATMs from attacks with the help of malicious tools like Cutlet Maker and in addition to providing reliable physical security to ATMs, Kaspersky Lab specialists advise financial organisations security teams to do the following:

• Implement strict default-deny policies preventing any unauthorised software from running on the ATM.
• Enable device control mechanisms to restrict the connection of any unauthorised devices to the ATM.
• Use a tailored security solution to protect your ATMs from attacks from the likes of the Cutlet Maker malware.

For better ATM protection Kaspersky Lab also recommends to use a proper security solution, such as Kaspersky Embedded Systems Security.

Kaspersky Lab products successfully detect and block the Cutlet Maker malware.

To read more about how Cutlet Maker works, read the recent blogpost on Securelist.com.

This analysis continues Kaspersky lab’s ongoing research into financial malware targeting ATMs. You can learn more about the evolution of ATM attacks in Kaspersky Lab’s report on Future attack scenarios against ATM authentication systems.