Cutlet Maker consists of three components and enables ATM jackpotting if the attacker is able to gain physical access to the machine. A toolset potentially allowing criminals to steal millions was on sale for just £3,788 and came equipped with a step-by-step user guide.

ATMs continue to be lucrative targets for fraudsters, who use various methods to extract maximum profit. While some rely on physically destructive methods through the use of metal cutting tools, others choose malware infection, enabling them to manipulate cash dispensers from the inside. Although malicious tools for hacking ATMs have been known for many years, the latest discovery shows that malware creators are investing more and more resources into making their “products” available for criminals who are not very familiar with computer science.

Cutlet Maker had been on sale since 27 March 2017, however as researchers discovered, the earliest known sample came on the radars of the security community in June 2016. At that time it was submitted to a public multi-scanner service from Ukraine, but later submissions from other countries were also made.  It is unknown who is behind this malware. Regarding potential sellers of the toolkit, language, grammar and stylistic mistakes point to the fact they are non-native English speakers.

“Cutlet Maker requires almost no advanced knowledge or professional computer skills from the criminal, transforming ATM hacking from a sophisticated offensive cyber operation into yet another illegal way to earn money that is available to practically anyone who has several thousand dollars to purchase the malware. This may potentially become a dangerous threat to financial organisations. But what is more important is that while operating, Cutlet Maker interacts with the ATMs software and hardware, encountering almost no security obstacles at all. This should be changed in order to harden ATM machines,” says Konstantin Zykov, security researcher at Kaspersky Lab.

In order to protect ATMs from attacks with the help of malicious tools like Cutlet Maker and in addition to providing reliable physical security to ATMs, Kaspersky Lab specialists advise financial organisations security teams to do the following:

Implement strict default-deny policies preventing any unauthorised software from running on the ATM.

Enable device control mechanisms to restrict the connection of any unauthorised devices to the ATM.

Use a tailored security solution to protect your ATMs from attacks from the likes of the Cutlet Maker malware.

For better ATM protection Kaspersky Lab also recommends to use a proper security solution, such as Kaspersky Embedded Systems Security.