ATM vulnerable of getting hacked and giving money to hackers with the help of malware called ploutus developed by spanish hackers as it is being said.
Mobile phone is connected to the ATM
The criminals can remotely control the ATM by using a mobile phone which is connected to the inside of the ATM. There are a lot of ways to connect a mobile phone to an ATM. One of the method is USBtethering, which is a shared Internet connection between a phone and a computer.
The attackers need to set the phone up correctly, connect it to the ATM and infect the ATM with Ploutus. Once all of these steps are complete, a full two-way connectivity is established and the phone is ready to be used.
Since the phone is connected to the ATM through the USB port, the phone also draws power from the connection, which charges the phone battery. As a result, the phone will remain powered up indefinitely.
SMS is sent to the ATM
After the mobile phone is connected to the ATM and set up is completed, the criminals can send specific SMS command messages to the phone attached inside the ATM. When the phone detects a new message under the required format, the mobile will convert the message into a network packet and will forward it to the ATM through the USB cable.
The network packet monitor (NPM) is a module of the malware which acts as a packet sniffer, watching all network traffic going on in the ATM. As soon as the compromised ATM receives a valid TCP or UDP packet from the phone, the NPM will parse the packet and search for the number “5449610000583686” at a specific offset within the packet in order to process the whole package of data. Once that specific number is detected, the NPM will read the next 16 digits and use them to construct a command line to run Ploutus. An example of such a command is shown below:
cmd.exe /c PLOUTOS.EXE 5449610000583686=2836957412536985
Using SMS messages to remotely control the ATM is a much more convenient method for all of the parties in this scheme, because it is discrete and works almost instantly. The master criminal knows exactly how much the money mule will be getting and the money mule does not need to linger for extended periods around an ATM waiting for it to issue the cash. The master criminal and money mule can synchronize their actions so that the money is issued just as the money mule pretends to withdraw cash or is walking past the ATM
SOURCE