ATMDtrack

Often, the purpose of ATM malware is to empty the contents of the Advanced Teller Machine, therefore causing no harm to the bank's customers. However, there also are particular ATM malware families that operate in a different manner – they infect the ATM device silently, and then collect credit card details from all customers who use the device continuously. Such is the case with the ATMDtrack ATM malware, a cyber-threat believed to be developed by the North Korean hackers known as the Lazarus group.

The activity of the ATMDtrack malware was first observed in 2018 when its payload was found on the computers responsible for the operations of ATM devices in India. Since then, the malware family has been reworked entirely, and nowadays it has evolved to a new malware strain called the Dtrack RAT, which packs some of the features typical for Remote Access Trojans.

Covert ATM Malware Collects Credit Card Information

As for ATMDtrack, it does not possess a wide range of features and, instead, it specializes in staying hidden and extracting the payment details of its victim silently. It is not clear how the Lazarus group managed to breach the security of the Indian banks and plant the ATMDtrack malware on them – it is suspected that they took advantage of outdated software and services or poorly secured network credentials.

Attacks against financial institutions are threatening specially, since they may end up causing harm to the innocent bank customers who have no way to protect themselves when the bank's infrastructure has been compromised.