Cash machine hackers have made 'millions' with Tyupkin malware

Photograph: Kaspersky

Criminals have made millions of dollars by physically installing malware on cash machines across the world, Interpol and security company Kaspersky have warned.

More than 50 Windows-based ATMs at banks in Eastern Europe are known to have been infected by the Tyupkin malware, which allowed the gang's money mules to enter codes into a cash machine to withdraw funds.

It would have required significant planning, as the mules had to be at the infected cash machines at specified times on either Sunday or Monday nights. The machines were compromised after the criminals inserted a bootable CD before uploading their malicious kit.

The key required to access the malware was also randomly created and only once, making it almost impossible for those outside of the gang to use it. Once the malicious software was brought to life, the mules were able to draw up to 40 notes, depending on how much cash was in the machine.

The gang has continued to improve Tyupkin since Kaspersky started tracking it in January, after an unnamed financial institution asked for help. One major upgrade added capability that disabled McAfee Solidcore security software to further avoid the chance of detection.

Kaspersky believes nations on other continents are affected, including the US and India, but not the UK. Interpol has started warning banks in the related countries.

Kaspersky Lab principle security researcher Vicente Diaz said the attacks were not particularly sophisticated in comparison to other ATM , but they were clearly effective. 'It's a very well organised operation,' he told the Guardian.

A similar malware, known as Ploutus, was seen spreading in South America earlier this year. In that case, the criminals were able to withdraw funds by simply texting the machine. But again they needed access to the machine and had to install another mobile within the ATM.

Despite the physical side of the illicit operations, criminals have still been able to make millions. Banks have been urged to take action.

'The fact that many ATMs run on operating systems with known security weaknesses and the absence of security solutions is another problem that needs to be addressed urgently,' Kaspersky Lab added in a blog post.

'Our recommendations for the banks is to review the physical security of their ATMs and consider investing in quality security solutions.'

* Want to catch a virus? Cheryl Cole is UK's most dangerous celebrity