Crooks used malware to rob 21 ATMs across Thailand

Aug 24, 2016 13:35 GMT  ·  By

The Government Savings Bank (GSB) of Thailand announced yesterday it shut down around 3,300 of its 7,000 ATMs nationwide following the discovery of a heist that allowed crooks to get away with $378,000 (12 million baht).

The ATM heists took place between August 1 and 8 and targeted ATMs sold by NCR, a US-based corporation that makes kiosks, payment systems, and other hardware used in the financial market.

Following the discovery of the incident, the Bank of Thailand (BoT) has warned all local banks that deploy NCR ATMs. BoT say that there are over 10,000 NCR ATMs across Thailand.

GSB shut down 47 percent of its ATMs when it put its NCR ATMs offline. The bank didn't take down all NCR ATMs, leaving 600 still running, but these are in well-guarded locations, such as bank headquarters.

Malware used in the attacks

According to authorities, crooks installed malware on the ATMs which disconnected the machine from the bank's network and allowed the crooks to dispense money without being detected.

Crooks robbed 21 ATMs in the Thai provinces of Bangkok, Chumphon, Prachuap Khiri Khan, Phetchaburi, Phuket and Surat Thani. They operated in groups, late at night.

Police are investigating the heists, Thai local media reported, and have contacted Taiwanese police for help, according to Taiwanese media, believing there might be a connection between these heists and the one from Taiwan, last month.

Incident may be connected to the ATM heists in Taiwan

At the start of July, news broke out about a gang that stole $2.18 million from ATMs in Taiwan. Initially, Taiwanese police said two individuals, one believed to be Russian, were behind the heist.

Later, they revealed that five Russian nationals were involved in the heist, a number that grew to 13 in the following days, but all initial suspects managed to flee the country.

A week after the heist, with the help of Interpol and Russia's embassy in Taiwan, police arrested three crooks: a Latvian, a Romanian, and a Moldavian. The suspects revealed their gang has 38 members, all from Eastern Europe.

The Taiwan ATM attacks targeted ATMs manufactured by Wincor Nixdorf, a German company, and also involved malware.