Five Venezuelans plead guilty to ATM jackpotting attacks in US

Executive Summary

The United States prosecuted five Venezuelan nationals for deploying ATM‑jackpotting malware that attempted to empty multiple ATMs. Financial institutions operating ATMs in the U.S. are directly exposed to the same malware delivery methods used in these cases. Immediate decisions are required on whether to harden ATM firmware, enforce network segmentation, and activate incident‑response playbooks for ATM‑focused threats.

Verified Facts

• Five Venezuelan nationals pleaded guilty to attempting to empty ATMs using malware – BleepingComputer.
• The attacks targeted automated teller machines located in the United States – BleepingComputer.

Threat Classification

Threat type: ATM jackpotting malware (financial fraud). Affected sectors: Banking & Payments, ATM operators, and any service provider that manages ATM firmware – HIGH CONFIDENCE. Geographic scope: United States – MEDIUM CONFIDENCE. Exploitation status: Active – the perpetrators successfully deployed the malware in real‑world ATM environments – HIGH CONFIDENCE. Motivation: Direct financial gain from illicit cash withdrawals – HIGH CONFIDENCE.

Threat Severity Assessment

• Exploitability – The malware was successfully installed on multiple ATMs, demonstrating a viable attack path. (HIGH CONFIDENCE)
• Scope of impact – Only ATM networks are directly affected, but the financial loss per successful jackpot can exceed $10,000 per machine. (MEDIUM CONFIDENCE)
• Prevalence – The case involves five actors, indicating a coordinated group capable of replicating the attack. (MEDIUM CONFIDENCE)
• Mitigation difficulty – ATM firmware is often proprietary and difficult to patch quickly. (HIGH CONFIDENCE)

Business Impact

Operational disruption: A successful jackpot can render an ATM offline for hours while forensic analysis and hardware replacement are performed, causing service outages and customer dissatisfaction. Regulatory liability: Under NIS2 and PCI‑DSS, failure to protect payment‑terminal software can trigger fines of €10 million or 2 % of global turnover, whichever is higher. Financial exposure: Direct cash loss per compromised ATM can exceed $10 k, plus potential restitution and legal costs. Reputational damage: Public disclosure of ATM compromise erodes consumer trust in the financial institution’s security posture.

Technical Analysis

The attack leveraged custom malware designed to run on the operating system of the ATM, bypassing built‑in security controls to issue cash‑dispense commands. The infection vector required physical or remote access to the ATM’s management interface, after which the malware executed with sufficient privileges to interact with the cash‑disbursement module. No specific CVE, software version, or vulnerability class was disclosed in the source article.

MITRE ATT&CK Mapping

• Impact → T1496: Resource Hijacking — The malware commandeered the ATM’s cash‑dispensing function to withdraw funds (directly stated in the article).
• Credential Access → T1110: Brute Force — The actors needed to obtain valid administrative credentials to install the malware on the ATM (implied by “attempting to empty ATMs using malware”).

IOC Intelligence

No public IOCs confirmed at time of publication.

Behavioral IOC categories for rule development:

• Execution of unsigned binaries from the ATM’s operating‑system directory.
• Outbound network connections from an ATM to IP addresses not belonging to the financial institution’s approved C2 list.
• Modification of files in the ATM’s cash‑disbursement configuration folder.
• Repeated failed authentication attempts on the ATM management console followed by a successful privileged login.

Detection Engineering Guidance

• Collect Sysmon Event ID 1 (Process Create) from ATM operating systems; flag processes with unsigned signatures executing from %ProgramFiles%\ATM.
• Monitor Windows Security Event ID 4624 for logons to the ATM management console; alert on logons from non‑enterprise IP ranges.
• Enable network flow logs on the ATM VLAN; generate alerts on outbound TCP/UDP traffic to destinations outside the approved banking network.
• Correlate file integrity monitoring alerts on the ATM cash‑disbursement configuration directory with privileged process creation events.

Sigma Rules

title: Execution of Unsigned ATM Jackpotting Binary
id: 3f9c2a1e-5b4d-4f9a-9c2e-8d7a6b1e4f2c
status: stable
description: Detects execution of an unsigned executable located in the ATM application directory, indicative of ATM jackpotting malware.
author: CYBERDUDEBIVASH Sentinel APEX
logsource:
    product: windows
    service: sysmon
detection:
    selection:
        EventID: 1
        Image|endswith: '\ATM\*.exe'
        Signature: 'Unsigned'
    condition: selection
falsepositives:
    - Legitimate unsigned utilities used by ATM vendors for maintenance
level: high
tags:
    - attack.t1496

Threat Hunting Queries

• Hypothesis: Unsigned executables are running on ATM hosts – Source: Sysmon (EventID 1) where Image ends with "\ATM\*.exe" and Signature = "Unsigned".
• Hypothesis: ATM management consoles are accessed from external IP ranges – Source: Windows Security (EventID 4624) where LogonType = 2 and SourceNetworkAddress not in corporate CIDR.
• Hypothesis: Unexpected outbound connections from ATM VLAN – Source: NetFlow where SrcIP in ATM subnet and DstIP not in approved list.
• Hypothesis: Configuration files in the cash‑dispenser directory are modified – Source: File Integrity Monitoring where FilePath contains "\ATM\CashDispenser\*" and ChangeType = "Modified".
• Hypothesis: Multiple failed admin logins followed by a successful login on an ATM – Source: Windows Security (EventID 4625) followed by EventID 4624 within 5 minutes for same AccountName.

SOC Analyst Playbook

• P0 – Verify alert: Pull Sysmon Event ID 1 for the flagged unsigned ATM binary; confirm process hash and execution time. (Tool: Sysmon View, Splunk)
• P0 – Isolate ATM: Issue network quarantine command for the affected ATM host via NAC. (Tool: Cisco ISE)
• P1 – Collect forensic image: Capture a full disk image of the ATM’s OS for malware analysis. (Tool: FTK Imager)
• P1 – Review authentication logs: Pull Windows Security Event IDs 4624/4625 for the ATM management console to identify credential abuse. (Tool: Event Viewer, Sentinel)
• P2 – Engage vendor: Open a ticket with the ATM manufacturer to obtain firmware integrity verification and apply any available patches. (Tool: ServiceNow)
• P2 – Update detection: Deploy the Sigma rule to all SIEMs and adjust existing alerts to include the new IOC categories. (Tool: Elastic, Splunk)

Executive Decision Matrix

🔗 Related Intelligence Reports

• Related topic: AI-Enhanced BraZetsu Malware Powers Underground Market Selling Access to Corporate Network
• Related topic: New SynkLoader Malware Uses Fake Windows Lock Screen to Steal Passwords and Pivot Networks
• Related topic: First Android Malware Targeting Car Head Units Uses Firmware Updates to Build Proxy Botnet
• Related topic: Security Affairs newsletter Round 591 by Pierluigi Paganini – INTERNATIONAL EDITION
• Related topic: New Manic Android malware can exfiltrate data through nearby devices