GreenDispenser: ATM Malware That Steals All The Cash And Then Deletes Itself

A new, and more sophisticated, kind of threat has been detected in the form of ATM malware that not only depletes an ATM of all of its cash, but also deletes itself after the heist to prevent itself from being detected. The malware is unique and is something that has never been seen before. It follows the same approach as an earlier piece of malware, termed “Padpin.”

The new malware, coined “GreenDispenser,” is much more advanced as it deletes itself after the cash is stolen from the ATM. GreenDispenser is even more sophisticated than “Suceful,” which was detected just a few weeks earlier. GreenDispenser interacts with the XFS middleware — XFS is a middleware application that is standard and is installed on all ATMs, regardless of their manufacturers.

XFS middleware interacts with the ATM software and other peripheral devices (like the pin pad) for entering details in the machine. GreenDispenser tricks the XFS middleware into recognizing it is an authorized, physical device on the machine.

The malware has two levels of pin protection so that only specific attackers can steal the money. When the attacker interacts with the machine, using the ATM pin pad with a static pin code, a QR code will be displayed. The attackers then use an app installed on their mobile phone which generates another code to be entered into the machine. After the attacker has entered the two pins, the machine dispenses all of the cash in it and deletes itself from the machine, leaving no trace that it ever even existed on the system.

The malware was detected by the security company Proofpoint, and they named the malware GreenDispenser. An infected machine shows a system error message on the screen to regular ATM users, but can be accessed by the attackers who have access to the two pins and the mobile application.