ATM Jackpotting.

An attack in which the cash dispenser of an ATM is forced to spit out all its cash, either via physical access to the top box or via a network compromise. It belongs to the Attacks & Threats category of cybersecurity.

An attack in which the cash dispenser of an ATM is forced to spit out all its cash, either via physical access to the top box or via a network compromise.

ATM jackpotting was demonstrated publicly by Barnaby Jack at Black Hat 2010 with the Tranax and Triton attack he called 'Jackpotting'. Modern attacks fall into two families. Physical: the operator opens the top box, plugs a Raspberry Pi or laptop into the dispenser, then loads malware such as Ploutus.D, Cutlet Maker or WinPot to issue XFS dispense commands and empty the cassettes in minutes. Network: a banking-network intrusion (FASTCash, used by the DPRK-linked Lazarus group against Asian and African banks from 2016 onward) pushes responses approving fraudulent withdrawals from mule cards. Defences include physical sensors on the top box, BIOS and full-disk encryption, application allowlisting on the ATM, dispenser firmware signing, and segregation/encryption of the ATM-to-switch connection.

Defences for ATM Jackpotting typically combine technical controls and operational practices, as detailed in the full definition above.

Common alternative names include: Jackpotting, Cash-out attack.