Kaspersky lab researchers have discovered a malware targeting ATMs, which was being openly sold on the DarkNet market. Cutlet Maker consists of three components and enables ATM jackpotting if the attacker is able to gain physical access to the machine. A toolset potentially allowing criminals to steal millions was on sale for just 5000 dollars and came equipped with a step-by-step user guide.
Earlier this year, a Kaspersky Lab partner provided one of our researchers with a previously unknown malicious sample presumably made to infect PCs running inside ATMs. Researchers were curious to see if this malware or something related to it was available to purchase on underground forums. A subsequent search for the unique artifacts of the malware was successful: an advertising offer describing a strain of ATM malware on a popular DarkNet spot – AlphaBay – matched the search query and revealed that the initial sample belonged to a whole commercial malware-kit created to jackpot ATMs.
A public post by the malware seller, found by researchers, contained not only the description of the malware and instructions on how to get it, but also provided a detailed step-by-step guide on how to use the malware-kit in attacks, with instructions and video tutorials.
According to the research, the malware toolkit consists of three elements:
• Cutlet Maker software, which serves as the main module responsible for communicating with the ATM’s dispenser.
• c0decalc program, designed to generate a password in order to run the Cutlet Maker application and protect it from unauthorized use.
• Stimulator application, which saves time for criminals by identifying the current status of ATM cash cassettes. By installing this app, an intruder receives exact information on the currency, value and number of notes in each cassette, so can then choose the one containing the largest amount, instead of blindly withdrawing cash one by one.
To begin the theft, criminals need to gain direct access to an ATM’s insides in order to access the USB port, which is used to upload the malware. If successful, they plug in a USB device which stores the software toolkit. As a first step criminals install Cutlet Maker. Since it is password protected they use a c0decalc program, installed on another device such as a laptop or tablet – this is a kind of “copyright” protection installed by authors of Cutlet Maker in order to prevent other criminals from using it for free. After the code is generated, criminals enter it into Cutler Maker’s interface to start the money removal process.
Cutlet Maker had been on sale since 27 Mar 2017, however as researchers discovered, the earliest known sample came on the radars of the security community in June 2016. At that time it was submitted to a public multi-scanner service from Ukraine, but later submissions from other countries were also made. It is not clear if the malware was used in actual in the wild attacks, however the guidelines that came with the malware kit contained videos which were presented by their authors as real life proof of the malware’s efficiency. It is unknown who is behind this malware. Regarding potential sellers of the toolkit, language, grammar and stylistic mistakes point to the fact they are non-native English speakers.
Kaspersky Lab specialists advise financial organizations security teams to do the following:
• Implement strict default-deny policies preventing any unauthorized software from running on the ATM.
• Enable device control mechanisms to restrict the connection of any unauthorized devices to the ATM.
• Use a tailored security solution to protect your ATMs from attacks from the likes of the Cutlet Maker malware.
For better ATM protection Kaspersky Lab also recommends to use a proper security solution, such as Kaspersky Embedded Systems Security. Kaspersky Lab products successfully detect and block the Cutlet Maker malware.