Malware: 2018 ATM Malware Automates Jackpotting

On February 19th, Kaspersky researchers reported on a new family of malware targeting ATMs called WinPot. This malware automates ATM “jackpotting” and designed its user interface to look like a slot machine. First discovered for sale on the dark web in March 2018, there are now three versions of the malware available. The basic mechanics of the malware are simple and common across all the malware families that offer jackpotting services, including CutletMaker and ShowMeMoney. The focus on the user interface demonstrates the evolution to a malware-as-a-service market model and the relative simplicity of crafting malware that can jackpot ATMs. Historically, advanced user interfaces for malware only are added on after the exploit or other functionality has become commoditized leading to multiple pieces of comparable malware being sold on the deep and dark web.

Recommendations

• In the ZeroFOX platform, leverage the dark and deep web data sources to monitor for the use, sale, or updates to the malware.
• On ATMs, enable device control and process whitelisting to prevent the ability for hackers to load and execute the malware onto vulnerable machines.

Details

Since March 2018, a new family of malware dubbed WinPot has been for sale on the deep/dark web. The malware has the same functionality as other ATM “jackpotting” malware in that it:

• Scans the money dispensing cassettes to determine the value of the currency and the quantity left;
• Allows for the automatic dispensal of funds from a selected cassette; and
• Provides basic start/stop and rescan capabilities to allow for maximum cash out.

It is currently being sold for between $500-$1000USD depending on the site and posting. This malware is a cheaper version of the CutletMaker malware that was discovered in 2017 and sold for $5000USD on forums. In addition to being cheaper, the malware is unique in the way its user interface was designed to look like a slot machine, playing on the colloquial term “jackpotting”. This type of coding is indicative of two things: first, the development effort to creating a workable piece of malware is low; and second, as malware-as-a-service continues to grow, malware authors are driven to create more unique and customer friendly user interfaces.

WinPot is currently on its third version with the malware adapting to circumvent:

• ATM security systems; and
• Exploitation of error handling to circumvent limitations on currency dispersal.