Hackers are targeting ATMs in India with new malware that steal data

A banking malware named ATMDTrack  has been active in India since late last summer, in a  kaspersky report .

Allegedly State sponsored Hackers from North Korean government have developed a new strain of malware that has been used to record and steal data from cards inserted into ATM machines in India.

Further analysis of the malware by the Moscow-based cybersecurity firm found the samples to be part of a bigger remote access trojan (RAT) called DTrack.

Calling it a spy tool to attack financial institutions and research centers in India, the experts said the malware strains shared “similarities with the DarkSeoul campaign, dating back to 2013 and attributed to the Lazarus group.”

The DTrack RAT was detected as recently as this month, the researchers noted.

Collecting key logs and browser histories

The threat actors behind DTrack obfuscated their malicious code in an innocuous executable file that was protected behind encryption barriers in a dropper used to install the malware.

Aside from disguising itself as a harmless process, the malware can perform a number of operations such as:

• .Keylogging
• .Retrieving browser history
• .Gathering host IP addresses, information about available networks and active connections
• .Listing all running processes
• .Listing all files on all available disk volumes

The collected data was then archived as a password-protected file that’s either saved to the disk or sent to a command-and-control server.

Classifying ATMDTrack as a subset of the DTrack family, the researchers said the developers behind the two malware strains are the “same group of people.”

Given the sophistication of the modus operandi, it’s recommended that target organizations beef up their network and password policies and monitor network traffic for any suspicious behaviour.

The kaspersky report also says the vast amount of DTrack samples that they found shows that the Lazarus group is one of the most active APT groups in terms of malware development, And they see that this group uses similar tools to perform both financially-motivated and pure espionage attacks.

I feel Banks need to go extra mile for searching and weeding out this malware from the ATM’s . ATM have come out as the last mile vulnerability in Indian banking industry due to usage of vulnerable OS and lack of physical security.