Oh, banks have cameras? Two men arrested for ATM jackpotting scheme must've forgot

Perpetrators dress up like repair technicians and then use malware to get the ATM to eject thousands of dollars of cash.

The U.S. Justice Department charged two men with hacking ATMs inside Connecticut banks in full view of surveillance cameras.  The scheme, known as “ATM jackpotting,” ends with ATM machines dispensing large amounts of cash like a casino jackpot.

The accused are Alex Alberto Fajin-Diaz, 31, of Spain, and Argenys Rodriguez, 21, of Massachusetts. Facing up to 30 years in prison if convicted, the pair appeared before a federal judge on Monday.

Fajin-Diaz and Rodriguez allegedly dressed as repair staff, walked into banks and used malware to get the ATM machines to eject all of their money. The haul was thousands of dollars in cash each time.

Police were alerted on Jan. 27, when Citizens Bank investigators observed an attack on an ATM in Cromwell, Connecticut. Police found Fajin-Diaz and Rodriguez near an ATM that was still in the process of ejecting $20 bills.

When police approached the suspects’ car, they found tools and electronic devices consistent with items needed to compromise an ATM machine: multiple license plates, screwdrivers, pliers, Allen wrenches, a black nylon bag full of money and the digital equivalent of a smoking gun: A square black electronic device that resembled an Apple TV, according to a police officer. A further search found a wealth of cables, wires, connectors and a keyboard.

Here’s a photo from FireEye featuring a keyboard attached to an ATM port:

When a legitimate ATM technician arrived in Cromwell, they found the ATM machine’s inner components had been accessed, a foreign cable was connected and a skimming device was inserted to capture all the bank cards unknowing customers were using.

Police also found over $9,000 in $20 bills.

Rodriguez denied being part of a malware attack. He told police that the ATM was ejecting cash so they took the money and put it in their car.

Despite the arrests, U.S. prosecutors say there are numerous other “cash-out teams” on the loose.

In a surveillance video dated January 22, two dressed as Diebold technicians accessed a Citizens Bank ATM in Providence, Rhode Island. Prosecutors believe they were installing malware. Two other men approached the ATM and look like they’re collecting cash. Around $50,000 was found to be missing.

“Pictures of these suspects do not appear to match the physical description of Fajin-Diaz and Rodriguez,” U.S. Secret Service Special Agent Molly Reale wrote on a sworn affidavit last week.

The Secret Service warned banks about such scams last week.

[documentcloud url=”http://www.documentcloud.org/documents/4367068-Jackpotting.html” width=675 height=500]

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

Technology

• European parliament members call for slowdown of Serbia’s EU entry over spyware use

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Attackers exploit zero-days in consistently besieged SonicWall product

• Dogged Russia-based botnet dismantled after 23-year run

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure