WASHINGTON—The FBI is warning financial institutions of a worldwide ATM cash-out scheme expected to happen in the coming days.
The agency issued a confidential alert to financial institutions; authorities say cybercriminals plan to use cloned cards to withdraw millions of dollars from ATMs around the world in just a few hours, Krebs on Security reported.
Krebs stated that the FBI said the scheme is "likely associated with an unknown card issuer breach and commonly referred to as an 'unlimited operation.'" An unlimited operation uses malware to compromise a financial institution or payment card processor and access consumers' card information and bank networks.
The FBI said small and mid-sized financial institutions are often targeted. The cybercriminals will alter fraud controls at the financial institution and accounts to ensure they can retrieve large amounts of cash from the ATM, Krebs stated.
What the FBI is Advising
The FBI advised FIs to:
- Implement separation of duties or dual authentication procedures for account balance or withdrawal increases above a specified threshold
- Implement application whitelisting to block the execution of malware
- Monitor, audit and limit administrator and business critical accounts with the authority to modify the account attributes mentioned above
- Monitor for the presence of remote network protocols and administrative tools used to pivot back into the network and conduct post-exploitation of a network, such as Powershell, cobalt strike and TeamViewer
- Monitor for encrypted traffic (SSL or TLS) traveling over non-standard ports
- Monitor for network traffic to regions wherein the FI would not expect to see outbound connections from the financial institution