Skip to content ↓ | Skip to navigation ↓

On Thursday, Romanian law enforcement authorities announced the arrest of several members of an international criminal group suspected of orchestrating ATM malware attacks.

The operation – one of the first in Europe against this kind of threat – involved multiple house searches in Romania and the Republic of Moldova, leading to the arrest of eight individuals, reported the European Union’s law enforcement agency Europol in a press release.

The criminal gang reportedly leveraged Tyupkin malware to conduct “jackpotting attacks,” which allowed them to manipulate ATMs and illegally empty the machine’s cash cassettes, “causing substantial losses across Europe to the ATM industry.”

“ATM ‘Jackpotting’ refers to the use of a Trojan horse, physically launched via an executable file in order to target an ATM, thus allowing the attackers to empty the ATM cash cassettes via direct manipulation, using the ATM PIN pad to submit commands to the Trojan,” explained Europol.

According to ZDNet, the criminals stole about €900 ($980) during each attack. The malware, which was designed to operate only on weekends, automatically deleted itself from the ATM.

“[It] even killed the ATM’s internet connection during the theft, probably to prevent the machine from triggering an alarm,” ZDNet reported.

Furthermore, the criminals also inflicted at least €200,000 ($218,000) of damage on ATM machines located in several European countries.

“Over the last few years we have seen a major increase in ATM attacks using malicious software,” said Europol’s Deputy Director of Operations Wil van Gemet in a statement.

“The sophisticated cybercrime aspect of these cases illustrates how offenders are constantly identifying new ways to evolve their methodologies to commit crimes,” he added.

“To match these new technologically savvy criminals, it is essential, as it was done in this case, that law enforcement agencies cooperate with their counterparts via Europol to share information and collaborate on transnational investigations.”

The operation was carried out by the Romanian National Police and the Directorate for Investigating Organized Crimes and Terrorism (DIICOT), with the assistance of Europol and Eurojust, as well as a number of European law enforcement authorities.