Loading story…
Proofpoint reported on GreenDispenser, an ATM-focused malware family designed to compromise cash machines and facilitate fraudulent cash withdrawals. The malware was notable for targeting ATMs directly rather than traditional banking systems, indicating a specialized threat aimed at the endpoint where cash is dispensed.
The reporting described GreenDispenser as a distinct strain of ATM malware, underscoring the continued evolution of financially motivated attacks against banking infrastructure. Its emergence highlighted the risk that attackers with access to ATM environments can deploy purpose-built malware to manipulate machine functions, disrupt normal operations, and enable theft from affected terminals.
See the actors and campaigns active against you right now.
1 event from the most recent confirmed update back to the earliest known activity.
Proofpoint publicly disclosed and analyzed GreenDispenser as a new ATM malware family in a Threat Insight blog post titled "Meet GreenDispenser: A New Breed of ATM Malware." No earlier event details are provided in the reference content.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See the adversaries and campaigns active against your sector right now, ranked by what they're exploiting.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers detailed **ATMii** (`Backdoor.Win32.ATMii`), an ATM malware family designed to make infected machines dispense cash on command. The malware was shared by a financial-sector partner and consists of two components: an injector executable and an injected DLL that targets the proprietary `atmapp.exe` process and hooks XFS functionality through `msxfs.dll`. Once running, ATMii can scan for the cash dispenser service, collect cassette information, dispense a specified amount in a chosen currency, and delete its command file after execution. The malware requires direct access to the target ATM, either over the network or through physical access such as a USB device, underscoring the continued risk of local and internal compromise in ATM environments. Researchers described the code as relatively unsophisticated and noted signs such as a likely fake 2013 compilation timestamp and lack of support for **Windows XP**, despite that operating system remaining common in ATMs at the time. Recommended defenses included **application whitelisting** and **device control** to block unauthorized binaries and removable media used in cash-out attacks.
Aug 14, 2026
Researchers detailed **WinPot** (also called **ATMPot**), an ATM jackpotting malware family built to make ATMs from a major vendor automatically dispense cash from their cassettes. First seen in March 2018, the malware was later observed in multiple closely related samples with small updates, including different packers, revised operating time windows, and interface changes. The tool presents operators with a slot-machine-style control panel that can scan cassettes, start cash dispensing, and stop the process, while also refusing to run outside a preset time period. The report said WinPot had already been noted in the **2018 European Fraud Update** and was being sold on darknet markets for roughly **$500 to $1,000**. Researchers also linked the malware to tactics and tooling similar to **Cutlet Maker**-related activity, underscoring the continued commoditization of ATM cash-out attacks. Recommended mitigations included **device control** to block USB-based installation and **process allowlisting** on ATMs to prevent unauthorized code execution.
Aug 14, 2026
Kaspersky reported that the ATM malware **Skimer** continued to evolve years after its first appearance, with incident responders identifying a newer variant that gave attackers direct control over cash machines. The malware used the **Themida** packer, installed itself differently on **FAT32** and **NTFS** systems, patched the XFS service executable `SpiService.exe`, and loaded a malicious library, `netmgr.dll`, to obtain full access to ATM **XFS** functions. The malware remained dormant until an attacker inserted a specially crafted **magic card** containing hardcoded Track 2 data, then authenticated through PIN-pad command codes to trigger actions including cash dispensing, card-data collection and printing, PIN-related input logging, self-deletion, debugging, and malware updates from a card. Kaspersky said it identified **49 Skimer modifications**, including **37** aimed at ATMs from a single manufacturer, and urged banks to hunt for the hardcoded Track 2 values while strengthening controls such as application allowlisting, BIOS protection, disk encryption, and network isolation.
Aug 15, 2026