Loading story…
Researchers identified ATMJaDi, a targeted Java-based ATM malware used to cash out machines in Latin America after samples were uploaded from Mexico and later Colombia. Unlike most ATM malware, it does not rely on standard ATM middleware such as XFS, JXFS, or CSC; instead, it abuses proprietary Java classes embedded in a victim bank’s ATM software, making it effective only in a narrow set of environments. The malware was observed packaged as INJX_PURE.jar and was designed to interact directly with the ATM control process.
Once installed, ATMJaDi injects into the ATM application and starts an HTTP server that can trigger cash dispensing, execute JavaScript, load additional JAR files, enumerate JVM classes, and run Windows shell commands through cmd.exe. Researchers said the malware requires prior installation and network access to the targeted ATM, indicating the operators likely first compromised the bank’s internal infrastructure to reach ATM-connected networks. The code’s multilingual terminal messages included awkward Russian phrasing assessed as a likely false flag, while the malware’s use of custom bank-specific classes suggested the attackers had detailed knowledge of the victim ATM environment and possibly access to source code or a similarly configured test system.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
In spring 2019, researchers discovered a new Java-based ATM malware later named ATMJaDi. The samples were uploaded to a multiscanner service from Mexico and later from Colombia, indicating activity in at least those locations.
Securelist published an analysis describing ATMJaDi as a highly targeted ATM cash-out malware that abuses proprietary Java classes from a victim bank’s ATM software instead of standard ATM libraries. The report also assessed that the operators likely had prior access to the bank’s infrastructure or ATM environment to deploy and control the malware.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers detailed **ATMii** (`Backdoor.Win32.ATMii`), an ATM malware family designed to make infected machines dispense cash on command. The malware was shared by a financial-sector partner and consists of two components: an injector executable and an injected DLL that targets the proprietary `atmapp.exe` process and hooks XFS functionality through `msxfs.dll`. Once running, ATMii can scan for the cash dispenser service, collect cassette information, dispense a specified amount in a chosen currency, and delete its command file after execution. The malware requires direct access to the target ATM, either over the network or through physical access such as a USB device, underscoring the continued risk of local and internal compromise in ATM environments. Researchers described the code as relatively unsophisticated and noted signs such as a likely fake 2013 compilation timestamp and lack of support for **Windows XP**, despite that operating system remaining common in ATMs at the time. Recommended defenses included **application whitelisting** and **device control** to block unauthorized binaries and removable media used in cash-out attacks.
Aug 14, 2026
Investigators tied a targeted ATM cash-out intrusion at a Russian bank to **ATMitch**, a malware family designed to remotely administer ATMs from inside a bank network. In the incident, attackers gained access to the bank environment, reached ATMs over **RDP**, and deployed the malware as `tv.dll`, later removing it to hinder recovery. Although the original executables were not preserved, forensic analysis of ATM hard drives recovered log files and deleted filenames that allowed researchers to identify the tool and reconstruct its operation. ATMitch uses the **XFS** library to send dispenser instructions to cash machines through a one-character instruction file named `command.txt`, giving operators a simple way to trigger cash withdrawals on compatible devices. The case aligns with broader reporting on ATM cash-out malware, including material associated with **Operation Fast Cash** and **Hidden Cobra**, underscoring how attackers have used specialized malware to manipulate ATM infrastructure and dispense cash directly from compromised banking environments.
Aug 14, 2026
Kaspersky reported that ATM and point-of-sale malware activity rose sharply in 2018 and remained high in 2019, with detections concentrated in Russia, Brazil, Iran, Vietnam, India, the United States, and several European countries. Russia consistently recorded the highest number of affected devices, underscoring the global scale of attacks targeting payment infrastructure. The report linked the sustained threat to outdated software, unpatched vulnerabilities, weak physical security, and the operational limits of vendor-managed ATM environments. It identified active malware families including **ATMJackpot**, **WinPot**, **Ice5**, **ATMTest**, **Peralta**, **ATMWizX**, **ATMDtrack**, **ATMgot**, **ATMqotX**, and **ATMJaDi**, which support cash-out schemes, card-data theft, and anti-forensic functions, while noting that older malware continues to be reused and that a malware-as-a-service trend is emerging from Latin America.
Aug 14, 2026