Loading story…
Kaspersky reported that the ATM malware Skimer continued to evolve years after its first appearance, with incident responders identifying a newer variant that gave attackers direct control over cash machines. The malware used the Themida packer, installed itself differently on FAT32 and NTFS systems, patched the XFS service executable SpiService.exe, and loaded a malicious library, netmgr.dll, to obtain full access to ATM XFS functions.
The malware remained dormant until an attacker inserted a specially crafted magic card containing hardcoded Track 2 data, then authenticated through PIN-pad command codes to trigger actions including cash dispensing, card-data collection and printing, PIN-related input logging, self-deletion, debugging, and malware updates from a card. Kaspersky said it identified 49 Skimer modifications, including 37 aimed at ATMs from a single manufacturer, and urged banks to hunt for the hardcoded Track 2 values while strengthening controls such as application allowlisting, BIOS protection, disk encryption, and network isolation.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
The most recent Skimer version covered in the report was discovered at the beginning of May 2016. This variant used techniques such as patching SpiService.exe and loading a malicious netmgr.dll library to access ATM XFS functions.
During incident response work, Kaspersky identified a newer and improved version of Skimer, showing the malware had continued to evolve. The report says the most recent version described was discovered at the beginning of May 2016.
The ATM malware family Skimer was first observed, marking the emergence of malware designed for direct ATM cash-out operations.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Kaspersky Lab reported that the **Tyupkin** malware infected more than 50 ATMs, primarily **Microsoft Windows 32-bit** machines from a major manufacturer, and enabled criminals with physical access to authenticate to the terminal, inspect how much cash was loaded in each cassette, and force the machine to dispense **40 notes** from a selected cassette. Investigators said the malware was installed using a **bootable CD**, persisted through a Windows **Run** registry key, and interacted with the dispenser through the standard ATM library `MSXFS.dll`. The campaign was concentrated in Eastern Europe, but telemetry suggested the malware had also surfaced in the **United States, India, and China**. Kaspersky said Tyupkin operated only during specific nighttime windows and used per-session keys to restrict unauthorized use, while later variants added **anti-debugging**, **anti-emulation**, and the ability to disable **McAfee Solidcore**. The findings highlighted a shift from card skimming toward direct attacks on banks through ATM cash-out operations, prompting recommendations for stronger physical ATM security, non-default locks and keys, functioning alarms, and dedicated security software.
Jun 29, 2026
Researchers detailed **ATMii** (`Backdoor.Win32.ATMii`), an ATM malware family designed to make infected machines dispense cash on command. The malware was shared by a financial-sector partner and consists of two components: an injector executable and an injected DLL that targets the proprietary `atmapp.exe` process and hooks XFS functionality through `msxfs.dll`. Once running, ATMii can scan for the cash dispenser service, collect cassette information, dispense a specified amount in a chosen currency, and delete its command file after execution. The malware requires direct access to the target ATM, either over the network or through physical access such as a USB device, underscoring the continued risk of local and internal compromise in ATM environments. Researchers described the code as relatively unsophisticated and noted signs such as a likely fake 2013 compilation timestamp and lack of support for **Windows XP**, despite that operating system remaining common in ATMs at the time. Recommended defenses included **application whitelisting** and **device control** to block unauthorized binaries and removable media used in cash-out attacks.
Aug 14, 2026
Kaspersky reported that ATM and point-of-sale malware activity rose sharply in 2018 and remained high in 2019, with detections concentrated in Russia, Brazil, Iran, Vietnam, India, the United States, and several European countries. Russia consistently recorded the highest number of affected devices, underscoring the global scale of attacks targeting payment infrastructure. The report linked the sustained threat to outdated software, unpatched vulnerabilities, weak physical security, and the operational limits of vendor-managed ATM environments. It identified active malware families including **ATMJackpot**, **WinPot**, **Ice5**, **ATMTest**, **Peralta**, **ATMWizX**, **ATMDtrack**, **ATMgot**, **ATMqotX**, and **ATMJaDi**, which support cash-out schemes, card-data theft, and anti-forensic functions, while noting that older malware continues to be reused and that a malware-as-a-service trend is emerging from Latin America.
Aug 14, 2026