News

Tyupkin takedown: European authorities crack ATM malware ring

A coordinated multinational operation netted eight suspects whose ATM jackpotting scheme is said to have resulted in 'substantial losses' across Europe.

January 7, 2016

Chalk one up for the good guys.

This week, Europol announced that it has dismantled an international crime ring responsible for ATM malware attacks that have resulted in "substantial losses" to the ATM industry across Europe.

The multinational law enforcement operation — one of Europe's first against this type of threat, Europol said — resulted in multiple house searches in Romania and the Republic of Moldova and the arrest of eight individuals.

The operation was carried out by the Romanian National Police and the Directorate for Investigating Organised Crimes and Terrorism, with assistance from Europol, Eurojust and other European law enforcement authorities, according to the announcement.

Members of the criminal group, composed of Romanian and Moldovan nationals, used Tyupkin ATM malware to "jackpot" machines. The criminals would first compromise the exterior of the machine in order to gain access to the hard drive; an executable file was then uploaded to the drive, allowing the criminals to submit commands using the ATM PIN pad.

"Over the last few years we have seen a major increase in ATM attacks using malicious software," Europol Deputy Director of Operations Wil van Gemert said in the announcement. "The sophisticated cybercrime aspect of these cases illustrates how offenders are constantly identifying new ways to evolve their methodologies to commit crimes. To match these new technologically savvy criminals, it is essential, as it was done in this case, that law enforcement agencies cooperate with their counterparts via Europol to share information and collaborate on transnational investigations".

EC3, the European Cybercrime Centre established by Europol, has worked with the European ATM Security Team to develop guidelines for combatting this new cyber threat to ATMs.

Europol referred to the joint effort as an example of a coordinated response by law enforcement and the ATM industry to respond quickly and effectively to such threats.