Malware

Alice

Alice is a lightweight ATM cash-dispensing malware family discovered by Trend Micro in November 2016. It targets Windows-based ATMs using Microsoft XFS middleware, allowing operators to command cash dispensers without a legitimate withdrawal transaction. Its functionality focuses on emptying ATM cash cassettes rather than collecting customer card data. Deployment requires physical access to the ATM, but the malware can run without a dedicated installation procedure. Operators interact with a PIN-protected interface using an attached keyboard. Its use of XFS enables operation across compatible ATM hardware rather than restricting it to one manufacturer. Alice targets financial institutions through ATM jackpotting. The name is also used by a separate ransomware-as-a-service offering marketed as Alice in the Land of Malware.

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

9 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

1 technique

T1200Hardware AdditionsEvidence2

Back then, we observed that the main infection vector was purely physical: The criminal had to physically open the casing of the ATM and access the machine’s internals to boot up from an external USB or CD.

Execution

4 techniques

T1047Windows Management InstrumentationEvidence1

MITRE ATT&CK® Techniques ... Execution ... T1047 ... Windows Management Instrumentation

T1053Scheduled Task/JobEvidence1

MITRE ATT&CK® Techniques ... Persistence ... T1053 ... Scheduled Task/Job

T1059Command and Scripting InterpreterEvidence1

MITRE ATT&CK® Techniques ... Execution ... T1059 ... Command and Scripting Interpreter

T1204User ExecutionEvidence1

MITRE ATT&CK® Techniques ... Execution T1204 ... User Execution

Persistence

2 techniques

T1053Scheduled Task/JobEvidence1

MITRE ATT&CK® Techniques ... Persistence ... T1053 ... Scheduled Task/Job

T1547.001Registry Run Keys / Startup FolderEvidence1

MITRE ATT&CK® Techniques ... Persistence T1547.001 ... Registry Run Keys / Startup Folder

Privilege Escalation

2 techniques

T1053Scheduled Task/JobEvidence1

MITRE ATT&CK® Techniques ... Persistence ... T1053 ... Scheduled Task/Job

T1547.001Registry Run Keys / Startup FolderEvidence1

MITRE ATT&CK® Techniques ... Persistence T1547.001 ... Registry Run Keys / Startup Folder

Stealth

1 technique

T1497Virtualization/Sandbox EvasionEvidence1

MITRE ATT&CK® Techniques ... Defense Evasion T1497 ... Virtualization/Sandbox Evasion

Discovery

2 techniques

T1087Account DiscoveryEvidence1

MITRE ATT&CK® Techniques ... Discovery T1087 ... Account Discovery

T1497Virtualization/Sandbox EvasionEvidence1

MITRE ATT&CK® Techniques ... Defense Evasion T1497 ... Virtualization/Sandbox Evasion

Impact

1 technique

T1486Data Encrypted for ImpactEvidence1

This ransomware uses the AES encryption algorithm to encrypt files ... After that, the malware starts the encryption process by enumerating the directories and encrypts the victim’s files using the AES-256-CTR algorithm, appending the extension as '.octo' ... Successful execution of Alice ransomware encrypts the victim’s files and appends the extension as '.alice' ... MITRE ATT&CK® Techniques ... T1486 ... Data Encrypted for Impact

INDICATORS OF COMPROMISE

IOCs tracked for this family

5 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Hashes

5 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

TypeValueLatest sighting

hash.sha256●●●●●●●●●●●●View more in app7 years ago

ACTIVITY FEED

Recent activity

4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

4 SOURCESView more in app

bleeping computerNews

Oct 2, 2026

US sanctions Tren de Aragua gang members in ATM hacks crackdown

Listed among malware examples used in ATM jackpotting attacks against financial institutions. No Alice-specific behavior or campaign attribution is supplied.

cyble blog historicNews

Nov 18, 2022

AXLocker, Octocrypt & Alice: New Wave Of Ransomware

RaaS ransomware advertised on cybercrime forums with a builder that generates Encryptor.exe and Decryptor.exe, appends the .alice extension to encrypted files, and drops ransom notes named 'How to Restore Your Files.txt'.

talosintelligence otherNews

May 30, 2019

10 years of virtual dynamite: A high-level retrospective of ATM malware

ATM cash-dispensing malware requiring physical installation and operator PIN entry to access the dispenser module and retrieve cash.

trendmicro documentsNews

Aug 14, 2026

A lightweight, feature-lean ATM jackpotting malware focused solely on dispensing cash. It relies on XFS, does not need installation, requires a keyboard for commands, and appears designed to run on ATMs from any manufacturer using XFS.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching5

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping9

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Alice