Latest RIPPER Malware Makes Appearance In Thailands ATMs

An international arrest warrant has been issued for Rustam Shambasov, a 29-year-old Russian national viewed as a key suspect in an ongoing criminal probe in Thailand. According to local authorities, Shambasov is suspected of playing a role in a criminal gang that stole some 12 million baht (approx.$350,000) from malware-infected ATMs owned by Thailand's Government Savings Bank.

Law enforcement officials claim that CCTV cameras captured Shambasov's visiting 13 ATMs in separate locations in July in Bangkok and Phuket. The camera images were matched to a photocopy of his passport used to rent an SUV just prior to the thefts. Shambasov, who boarded a flight to Moscow in August, has since vanished from sight.

What makes the attack on Thailand's banks particularly disturbing is that it seems to be part of an international ring of tech-savvy ATM thieves. Shambasov is a suspected member of a gang that previously targeted banks in Taiwan in July to steal $2.17 million from hundreds of ATMs in a flash attack. The attack in Thailand prompted authorities to take offline about 3,000 bank ATMs.

These attacks are notable in that they employed a new form of highly sophisticated malware dubbed RIPPER. Widely viewed as the latest felonious innovation aimed at ATMs, RIPPER was designed to outwit existing security countermeasures. Once the malware is preinstalled on the ATM network, criminals then use a specially encoded EMV card and PIN to access various functions that allow them to drain the machine of cash, called "jackpotting" in cybercriminal parlance. Additionally, the malware cleverly disables the ATM's antifraud systems; so by the time the theft is detected, the thieves are long gone.

RIPPER is being installed on ATMs running older operating systems, and in countries where access required to load it is easily accomplished by means of bribery. However, law enforcement officials have expressed concern that RIPPER or something similar could soon make an appearance in the U.S. and other developed nations.

THERE AND GONE:An international arrest warrant has been issued for Rustam Shambasov, a 29-year-old Russian national accused of stealing from ATMs in Thailand.