{"id":37363,"date":"2022-10-20T15:46:15","date_gmt":"2022-10-20T12:46:15","guid":{"rendered":"https:\/\/saudishopper.com.sa\/en\/?p=37363"},"modified":"2026-03-28T02:00:23","modified_gmt":"2026-03-27T23:00:23","slug":"atm-pos-malware-recovers-from-covid-19-with-the-number-of-attacks-continuing-to-grow-in-2022","status":"publish","type":"post","link":"https:\/\/saudishopper.com.sa\/en\/atm-pos-malware-recovers-from-covid-19-with-the-number-of-attacks-continuing-to-grow-in-2022\/","title":{"rendered":"ATM\/PoS malware \u201crecovers\u201d from covid-19, with the number of attacks continuing to grow in 2022"},"content":{"rendered":"\n

In 2020, the number of attacks on ATMs and PoS terminals significantly decreased due to the pandemic. Now, with old spending patterns back, threat actors\u2019 activity is on the up again. HydraPoS and AbaddonPoS are the most widespread malware families in 2022, accounting for roughly 71% of all detections. For ATMs the most active malware is Ploutus, accounting for 3% of all detections in the first eight months of 2022. These and other findings are part of a new ATM\/PoS malware\u00a0<\/strong>report<\/strong><\/a>\u00a0issued by Kaspersky.<\/strong><\/p>\n\n\n\n

Cybercriminals attack embedded systems used in ATMs and point-of-sale (PoS) terminals to steal cash, credit card credentials and personal data, and penetrate systems to gain control over all devices within a network, and attackers can obtain thousands of dollars overnight. Many Windows versions used in ATMs reached the end of their support long ago and may be an easy target, while PoS terminals are used by many businesses with a low cybersecurity maturity level.<\/p>\n\n\n\n

A look at the numbers: attackers\u2019 activity returning to pre-pandemic levels<\/strong><\/p>\n\n\n\n

When the pandemic hit, the number of attacks decreased sharply compared to the\u00a0previous year<\/a>\u00a0\u2013 from roughly 8000 in 2019 to 5000 in 2020. According to the experts\u2019 assessment, this occurred for several reasons \u2013 including a reduction in the total number of ATMs across the world, their shutdown during pandemic restrictions, as well as people\u2019s spending shrinking overall. As a consequence, attackers saw their market contract in terms of the number of their targets.<\/p>\n\n\n\n

Today the restrictions have softened greatly, old spending patterns are back, and therefore threat actors\u2019 activity is gathering pace. In 2021, the number of devices encountered with ATM\/PoS malware was up by 39% compared to the previous year. In the first eight months of 2022, the number grew by 19% compared to the same period of 2020, and by nearly 4% compared to 2021. In total, 4173 devices were attacked in January-August of 2022. <\/p>\n\n\n\n

\"\"\/<\/figure>\n\n\n\n

Number of unique devices that encountered ATM\/PoS malware in the first halves of 2020-2022<\/em><\/p>\n\n\n\n

Given this trend, experts expect the number of attacks on ATM\/PoS devices to increase further in the fourth quarter of 2022. <\/p>\n\n\n\n

PoS malware is the most widespread<\/strong><\/p>\n\n\n\n

HydraPoS and AbaddonPoS account for roughly 71% of all ATM\/PoS malware detections in 2020-2022, with 36% and 35%, respectively. The leader of the rating, HydraPoS, originates from Brazil and is known for cloning credit cards. According to Kaspersky Threat Intelligence Portal reports, this family was used in attacks involving social engineering. \u201cThere are different techniques. They depend on who is conducting the attack and which family is used. Attackers make phone calls or even come to victims\u2019 offices. They impersonate an employee of a bank or credit card company and try to convince the victim to install malware as if it were a system update<\/em>\u201d, comments Fabio Assolini, Head of Research Center, Latin America at Kaspersky. <\/p>\n\n\n\n

\u2116<\/strong><\/td>Family<\/strong><\/td>Share by detections<\/strong><\/td><\/tr>
1<\/td>HydraPoS<\/td>36%<\/td><\/tr>
2<\/td>AbaddonPoS<\/td>35%<\/td><\/tr>
3<\/td>Ploutus<\/td>3%<\/td><\/tr>
4<\/td>RawPoS<\/td>2%<\/td><\/tr>
5<\/td>Prilex<\/td>2%<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n

The most active ATM\/PoS malware families in 2022 by share of detections<\/em><\/p>\n\n\n\n

The TOP-5 also includes Ploutus (3%) \u2013 the malware family used for modifying legitimate software and privilege escalation to control ATMs and obtain administrative privileges that allow criminals to jackpot ATMs on demand. RawPoS (the malware able to extract the full magnetic stripe data from volatile memory) and Prilex<\/a> (the malware abusing processes related to PoS software and credit and debit card transactions), account for 2% per each. The other 61 analyzed families and modifications account for less than 2% per each.<\/p>\n\n\n\n

“PoS malware is more widespread than ATM malware because it gives fairly easy access to money. If ATMs are usually protected well enough, the owners of cafes, restaurants, and shops often don\u2019t even think about the cybersecurity of their payment terminals. This makes them a target for attackers. Moreover, new criminal business models like malware-as-a-service emerge to lower the skills bar for would-be threat actors,”<\/em> elaborates Fabio Assolini. <\/p>\n\n\n\n

To read the full ATM\/PoS malware report, please visit\u00a0Securelist.com<\/a>.<\/p>\n\n\n\n

In order to keep embedded systems and data safe, Kaspersky researchers recommend implementing the following measures:<\/p>\n\n\n\n