Loading story…
Investigators tied a targeted ATM cash-out intrusion at a Russian bank to ATMitch, a malware family designed to remotely administer ATMs from inside a bank network. In the incident, attackers gained access to the bank environment, reached ATMs over RDP, and deployed the malware as tv.dll, later removing it to hinder recovery. Although the original executables were not preserved, forensic analysis of ATM hard drives recovered log files and deleted filenames that allowed researchers to identify the tool and reconstruct its operation.
ATMitch uses the XFS library to send dispenser instructions to cash machines through a one-character instruction file named command.txt, giving operators a simple way to trigger cash withdrawals on compatible devices. The case aligns with broader reporting on ATM cash-out malware, including material associated with Operation Fast Cash and Hidden Cobra, underscoring how attackers have used specialized malware to manipulate ATM infrastructure and dispense cash directly from compromised banking environments.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
A GitHub repository added a PDF titled "Operation Fast Cash - Hidden Cobra’s AIX PowerPC malware dissected," making the analysis document available in the repository. The visible repository metadata shows the PDF was uploaded on December 31, 2018.
In June 2016, criminals gained control of ATMs at a Russian bank, uploaded malware to them, and remotely administered the machines to steal cash. The attackers removed the malware after the cash-out operation, complicating recovery of the original executables.
After the attack, the bank’s forensic team recovered log artefacts and deleted filenames from an ATM hard drive, then used the recovered information to create a YARA rule and identify a malware sample uploaded as "tv.dll." The sample, dubbed ATMitch, was linked to remote ATM administration via XFS commands over RDP access from within the bank network.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers detailed **ATMii** (`Backdoor.Win32.ATMii`), an ATM malware family designed to make infected machines dispense cash on command. The malware was shared by a financial-sector partner and consists of two components: an injector executable and an injected DLL that targets the proprietary `atmapp.exe` process and hooks XFS functionality through `msxfs.dll`. Once running, ATMii can scan for the cash dispenser service, collect cassette information, dispense a specified amount in a chosen currency, and delete its command file after execution. The malware requires direct access to the target ATM, either over the network or through physical access such as a USB device, underscoring the continued risk of local and internal compromise in ATM environments. Researchers described the code as relatively unsophisticated and noted signs such as a likely fake 2013 compilation timestamp and lack of support for **Windows XP**, despite that operating system remaining common in ATMs at the time. Recommended defenses included **application whitelisting** and **device control** to block unauthorized binaries and removable media used in cash-out attacks.
Aug 14, 2026
Kaspersky Lab reported that the **Tyupkin** malware infected more than 50 ATMs, primarily **Microsoft Windows 32-bit** machines from a major manufacturer, and enabled criminals with physical access to authenticate to the terminal, inspect how much cash was loaded in each cassette, and force the machine to dispense **40 notes** from a selected cassette. Investigators said the malware was installed using a **bootable CD**, persisted through a Windows **Run** registry key, and interacted with the dispenser through the standard ATM library `MSXFS.dll`. The campaign was concentrated in Eastern Europe, but telemetry suggested the malware had also surfaced in the **United States, India, and China**. Kaspersky said Tyupkin operated only during specific nighttime windows and used per-session keys to restrict unauthorized use, while later variants added **anti-debugging**, **anti-emulation**, and the ability to disable **McAfee Solidcore**. The findings highlighted a shift from card skimming toward direct attacks on banks through ATM cash-out operations, prompting recommendations for stronger physical ATM security, non-default locks and keys, functioning alarms, and dedicated security software.
Jun 29, 2026
The FBI reported a sharp increase in **ATM jackpotting** in the US, a cyber-physical attack in which criminals compromise ATMs and use malware to force cash dispensing without bank authorization. Since 2020, the FBI has tracked more than **1,900** incidents, including **700+ in 2025**, with losses exceeding **$20 million**; the activity is described as increasing and often difficult to detect until after cash is removed. The FBI said attackers commonly gain access by opening the ATM cabinet with **widely available generic keys**, then installing malware by removing the hard drive to copy the payload or swapping in a preloaded drive/device. Reported malware includes **Ploutus**, which abuses the *eXtensions for Financial Services* (**XFS**) API layer used by ATM applications to interface with hardware; by issuing their own XFS commands, attackers can **bypass bank authorization** and directly control cash-out functions. The FBI noted the technique can work across different ATM manufacturers with minimal code changes, leveraging the underlying **Windows** environment during compromise.
Jun 29, 2026