Organized Crime: The Engine Behind ATM Fraud

It’s important to understand that most logical and physical ATM attacks aren't the work of lone amateurs. These crimes are typically carried out by organized criminal groups with significant resources and international reach. 

ATM crime trends often originate internationally, with threat activity frequently first emerging in Europe or South America before migrating to the United States. These global attack patterns often serve as early indicators of the tactics that will eventually affect domestic machines.

Based on industry intelligence and field reports, many recent incidents have been traced back to Eastern European crime syndicates, with Romanian crime families frequently identified as key players in these schemes. These operations are highly coordinated and profit-driven, functioning more like illicit businesses than spontaneous crimes. 

The individuals executing the attacks at the branch level are often low-level operatives, following detailed instructions passed down from more sophisticated players who design and distribute the equipment. Many of the devices used in these attacks are readily available for purchase online. Some are listed openly on search engines, while more advanced versions are found on dark web marketplaces. These kits often include step-by-step instructions, and disturbingly, some vendors offer technical support hotlines that allow buyers to troubleshoot issues in real time, as if they were dealing with a legitimate software company.

This level of support and scalability shows that these aren't isolated incidents. They’re part of a global criminal infrastructure designed to quickly and discreetly extract liquid cash from Financial Institutions and their customers. 

As a result, Financial Institutions must treat these threats as organized business operations, not just individual crimes of opportunity.

Jackpotting Crews Typically Operate

in Coordinated Units as Four Distinct Roles:

Tech Team – responsible for the installation phase of the attack.

Command and Control – oversees operations and communication across the team.

Cash-Out Team – executes the physical withdrawal of funds from the ATM.



Remote Engineer – sometimes called the “organizer” or “engineer,” this person connects remotely to activate malware or provide the code needed to trigger it.

In many of these ATM attacks, you’ve got a group of on-site individuals handling the physical side of the operation, but they’re not the ones with technical expertise. 

The real threat is the remote engineer supporting them behind the scenes. These individuals have a deep understanding of both computing and ATM architecture, and they’re the ones custom-designing these attacks based on the specific hardware and software they encounter in the field.

Attackers will steal hard drives without much success, although the drives weren’t encrypted, they still couldn’t get the machines to dispense cash. But after a couple of weeks, they will solve whatever issue blocked them. Soon after, successful jackpotting attacks will increase significantly, suggesting that the attackers had refined their malware to work with those specific ATM models.

These are not opportunistic, low-skill hacks. They are well-coordinated, malware-driven jackpotting campaigns led by technically skilled individuals who are actively adapting their methods.

The Teams Generally Consist of Individuals Fulfilling Two Core Functions: 


• Installers (those who physically access and prepare the ATM) and cashers (those who execute the theft). 
  
• However, these roles often overlap—team members may rotate responsibilities across different attacks.
  

From the technical side, remote access software such as AnyDesk, TeamViewer, or FlexiHub is used to connect to stolen ATM hard drives. A common method involves removing the ATM's hard drive, connecting it to a cradle or docking station in a nearby vehicle, and providing hotspot connectivity. The remote engineer then accesses the drive from another location to probe it for vulnerabilities, often looking for unencrypted partitions. If found, malware is deployed to the drive, which is later reinserted to execute the attack.

Teams typically range from 2 to 8 individuals and often use multiple vehicles during an operation. These vehicles might not appear directly in FI surveillance footage, so observing traffic patterns and vehicle behavior around branches can be critical. Counter-surveillance is common.

Indicators and Attack Preparation

Before an actual jackpotting event, attackers often conduct extensive recon:

1. Taking photos or videos of the ATM while on a video call—often wearing earbuds or headphones.
   
2. Returning days later to carry out the attack. In some cases, hard drives are stolen in advance but not immediately exploited; this is a key red flag.
   
3. Attackers may even perform a hard drive swap to test whether vulnerabilities carry over due to lax security configurations.

Many regional banks and credit unions fall victim because they don’t have full security protocols in place. Attackers are known to test machines for weaknesses, especially in the dispenser or software. Older ATM models tend to be easy targets for attackers; they’re often considered the low-hanging fruit. 

Unfortunately, there’s only so much that can be done to secure those legacy systems due to their outdated hardware and software limitations.

Security Recommendations


• Encrypt all hard drives fully – attackers often test for unencrypted sectors they can exploit.
  
• Implement device whitelisting – prevent rogue hardware from being recognized by the ATM unless pre-approved by device ID.
  
• Monitor for recon behavior – unusual visits, photo-taking, or headphone use may indicate prep work.
  
• Stay vigilant for hard drive theft – even if nothing immediately follows, the theft itself is a precursor to a larger exploit.



Jackpotting Team Structure and Trends

1. There are 10 active groups working across various regions of the country at any given time.

• Attacks tend to occur in waves or cycles, with multiple teams carrying out coordinated activities simultaneously.
  

2. The individuals involved are predominantly foreign nationals. Historically, different types of fraud have been associated with distinct groups:

• Romanian Organized Crime for ATM Skimming
• Venezuelans for Jackpotting
• Cubans and Armenians for gas pump skimming. 


However, jackpotting in the U.S. emerged around 2017, having already been seen extensively across Europe, Central America, and South America. When early tests in the U.S. proved successful, organized criminal networks began repurposing Venezuelan crews already in the States to focus specifically on jackpotting activity.

Prevention and Response Protocols for Jackpotting Attacks are CRITICAL


1. Proactively update recommended security updates. 
   
2. Develop a well-structured incident response plan for an active attack. 


One key oversight we've seen is in how alarms are configured. While many institutions alarm the safe (where the cash is stored), they often neglect to alarm the top hat—the ATM's upper portion that can still be exploited.

We recommend alarming both the top and bottom portions of the ATM with audible alarms, and coordinating with and educating law enforcement to ensure tampering is not labeled as a false alert when the theft is not visible.

Contact your NuSource representative to discuss how to best protect your financial institution. Our techs and software are top-tier. 

NuSource.com

Protect and Prevent

If an ATM alarm is triggered or suspicious activity is detected, it's critical to immediately review surveillance footage and relay relevant details such as suspect description, clothing, vehicle type, or direction of travel to responding law enforcement. Ensure ATM field techs follow protocol, such as wearing gloves to avoid contaminating potential evidence.

This enables both the financial institution and law enforcement to confirm that an attempted tampering or attack is underway.

Where possible, institutions should be ready to remotely disable the ATM to prevent suspects from re-accessing the machine if they return.

Jackpotting is considered the #1 ATM-related crime in the U.S., with extremely high frequency. It’s not uncommon to receive one to three new incident reports per day. Disturbingly, investigators have identified over 400 individuals connected to these jackpotting crews, highlighting the scale and complexity of these operations.

NuSource and Sophos Stop ATM/ITM Jackpotting with NuGuard Central Device Encryption

NuGuard Central Device Encryption secures ATM and ITM hard drives against jackpotting and other threats by making unauthorized access and data theft virtually impossible—protecting sensitive information and critical assets.

Backed by NuSource’s deep financial institution security expertise and advanced technology, this solution delivers a smart, layered defense. Schedule a comprehensive security assessment at 800-873-1390 or info@nusourcefinancial.com to safeguard your operations and reputation.

ALERT ISSUED: Sept. 2nd, 2025

Recent reports confirm Direct Memory Access (DMA) attack attempts on ATMs in South America. Attackers physically connect devices (e.g., Raspberry Pi) to exposed PCIe interfaces to inject malicious files.

No successful attacks have been reported on Hyosung ATM/ITMs, but NuSource is proactively strengthening protections to safeguard our customers.

Learn more about DMA attacks here.

Hyosung Alert: End of life for Hyosung 76XX ATMs 

Your Hyosung 5100T, 5300XP, and 7600 ATMs have reached the end of life. Plans need to be made to replace these terminals. Please contact your NuSource representative to develop a comprehensive replacement strategy.

Impacted ATMS: 5100T / 5300XP / 7600

ACTION PLAN:

• Enable TLS 1.2: Contact your network provider to activate TLS 1.2 encryption on all ATM/ITM connections.  
• Without TLS 1.2 encryption, connections remain vulnerable to network-level attacks between ATMs and bank networks. FIs must contact their network providers directly to request TLS 1.2 activation.

Please work directly with your network to enable TLS 1.2

If you have questions or need clarification on this important requirement, please contact us today, and we will assist you with starting this process. 

OUR MISSION: Consistently deliver value-added solutions and quality

service experiences based on Integrity, Professionalism, and Teamwork. 

NuSource.com

NuSource Newsletter 2025