Netskope named a Leader in the 2022 Gartner® Magic Quadrant™ for Security Service Edge. Get the Report.

  • Platform

    Unrivaled visibility and real-time data and threat protection on the world's largest security private cloud.

  • Products

    Netskope products are built on the Netskope Security Cloud.

Netskope delivers a modern cloud security stack, with unified capabilities for data and threat protection, plus secure private access.

Explore our platform

Netskope Named a Leader in the 2022 Gartner Magic Quadrant™ for SSE Report

Get the report

Make the move to market-leading cloud security services with minimal latency and high reliability.

Learn more

Prevent threats that often evade other security solutions using a single-pass SSE framework.

Learn more

Zero trust solutions for SSE and SASE deployments

Learn more

Netskope enables a safe, cloud-smart, and fast journey to adopt cloud services, apps, and public cloud infrastructure.

Learn more
  • Customer Success

    Secure your digital transformation journey and make the most of your cloud, web, and private applications.

  • Customer Support

    Proactive support and engagement to optimize your Netskope environment and accelerate your success.

Trust Netskope to help you address evolving threats, new risks, technology shifts, organizational and network changes, and new regulatory requirements.

Learn more

We have qualified engineers worldwide, with diverse backgrounds in cloud security, networking, virtualization, content delivery, and software development, ready to give you timely, high-quality technical assistance.

Learn more
  • Resources

    Learn more about how Netskope can help you secure your journey to the cloud.

  • Blog

    Learn how Netskope enables security and networking transformation through security service edge (SSE).

  • Events & Workshops

    Stay ahead of the latest security trends and connect with your peers.

  • Security Defined

    Everything you need to know in our cybersecurity encyclopedia.

Security Visionaries Podcast

Bonus Episode: The Importance of Security Service Edge (SSE)

Play the podcast

Read the latest on how Netskope can enable the Zero Trust and SASE journey through security service edge (SSE) capabilities.

Read the blog

Netskope at RSA 2022

Meet and speak with Netskope security specialists at RSA.

Learn more

What is Security Service Edge?

Explore the security side of SASE, the future of network and protection in the cloud.

Learn more
  • Company

    We help you stay ahead of cloud, data, and network security challenges.

  • Why Netskope

    Cloud transformation and work from anywhere have changed how security needs to work.

  • Leadership

    Our leadership team is fiercely committed to doing everything it takes to make our customers successful.

  • Partners

    We partner with security leaders to help you secure your journey to the cloud.

Netskope enables the future of work.

Find out more

Netskope is redefining cloud, data, and network security to help organizations apply Zero Trust principles to protect data.

Learn more

Thinkers, builders, dreamers, innovators. Together, we deliver cutting-edge cloud security solutions to help our customers protect their data and people.

Meet our team

Netskope’s partner-centric go-to-market strategy enables our partners to maximize their growth and profitability while transforming enterprise security.

Learn more
Blog Threat Labs Netskope Discovers ATMJackpot Siphoning Cash
Apr 05 2018

Netskope Discovers ATMJackpot Siphoning Cash

Netskope Threat Research Labs has discovered a new ATM malware, “ATMJackpot.” The malware seems to have originated from Hong Kong and has a time stamp on the binary as 28th March 2018. It is likely that this malware is still under development. Compared with previously-discovered malware, this malware has a smaller system footprint, a very simple graphical user interface as shown in Figure 1 which displays the hostname along with the service provider information such as cash dispenser, PIN pad, and card reader information.

Figure 1: ATM malware GUI

In ATM “Jackpotting” attacks, the malware is installed on the ATM to dispense large amounts of cash. Jackpotting is on the rise as reported here, and similar attacks discovered in early 2014 targeted ATMs across Europe and Russia as reported here and here. Typically, ATM Malware propagates via physical access to the ATM using USB, and also via the network by downloading the malware on to already-compromised ATM machines using sophisticated techniques. Netskope for Web detects the download of this malware as Gen:Variant.Razy.255528.

Technical Analysis:

The ATMJackpot malware first registers the windows class name ‘WIN’ with a window procedure that is responsible for all of the malware activity as shown in Figure 2

Figure 2: Malware registers window class

After registering a window class, the malware creates the window, populates the options on the window, and initiates the connection with the XFS manager as shown in Figure 3. The GUI of the malware can be seen in Figure 1.

Figure 3: Malware creates window and initiates a connection with the XFS manager

After initiating a connection with the XFS manager, the malware opens the session with the service providers and registers to monitor the events as shown in Figure 4. The malware opens a session with CDM (cash dispenser), IDC (card reader) and PIN (pin pad) service providers.

Figure 4: Malware enumerates, open the service providers

After successful registration, the malware can monitor the events from different service providers and execute commands.

Commands:

  1. Malware reads the data from PIN pad asynchronously using WFSAsyncExecute API call as shown in Figure 5.
  2. Malware has the functionality to dispense cash as shown in Figure 6.
  3. Malware also has the functionality to eject the card as shown in Figure 7.

Figure 5: Read data from PIN Pad

Figure 6: Dispense cash

Figure 7: Eject ATM card

The following is the high-level XFS API information seen in the figures above:

WFSStartUp – Initiate a connection between an application and the XFS Manager

WFSOpen – Open a session between an application and a service provider

WFSRegister – Enable monitoring of a class of events by an application

WFSExecute – Send service-specific commands to a service provider

WFSGetInfo – Retrieve service-specific information from a service provider

Additional details on the background of the API’s and other ATM Malware are available here. Netskope Threat Research Labs will continue to monitor ATMJackpot malware and provide updates with additional findings.