Loading malware…
Atmosphere is a custom ATM attack tool used by the financially motivated Silence group in operations against banks and other financial institutions, primarily in Russia, the CIS, Eastern Europe, and later additional regions across Europe, Asia, and Africa. It is part of a broader intrusion toolkit used after initial compromise of a bank network, typically following spearphishing-based access and subsequent internal reconnaissance.
Atmosphere is designed for ATM jackpotting and remote cash-out operations. After operators identify the correct host running ATM management software, a dropper or injector component places the Atmosphere payload into the legitimate process responsible for sending commands to ATMs. Once active, the malware enables attackers to interact with ATM infrastructure by querying cassette status and triggering unauthorized cash withdrawals. Reporting also indicates it can support local physical control of an ATM through a specific keypad sequence, giving the operators flexibility between remote orchestration and on-site cash-out by mules.
The malware reflects the shift by Silence from attempted interbank transfer fraud to direct ATM-focused theft. Its deployment depends on prior compromise of bank environments and knowledge of ATM management workflows, making it more characteristic of post-compromise financial intrusion than opportunistic endpoint malware. Atmosphere has been associated with successful theft campaigns in which Silence coordinated fraudulent withdrawals through compromised banking infrastructure and cash-out teams. It targets Windows-based banking environments connected to ATM management systems and is notable as one of the bespoke tools that helped establish Silence as a capable and specialized banking threat actor.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
4 distinct techniques documented for this family, organized by ATT&CK tactic.
6 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Named ATM malware family included in the IOC set; no further functionality described in the content.
A malware/toolset developed by the Silence group for ATM-focused attacks, including jackpotting and cash-dispensing operations after the attackers identified systems running ATM-specific software.
DLL/charge utile ATM permettant de récupérer des informations sur les cassettes, de piloter à distance les retraits d’argent et de contrôler physiquement le DAB.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.