Unidentified hackers recently targeted specialized ATMs that distribute cryptocurrency, resulting in the theft of 56 bitcoins worth approximately $1.5 million. Unfortunately, the stolen funds included some belonging to customers who used the ATMs.
These ATMs allow users to connect them to a crypto application service (CAS), which can be managed by either the customer or the company. However, customers were also able to upload videos from the terminal to the CAS, and this is where the vulnerability was apparently hidden.
Threat actors took advantage of a recently discovered zero-day vulnerability to upload and run a malicious Java application, causing a depletion of the CASes belonging to both the company and its customers. This resulted in the company and its clients becoming targets of the attack.
Story Credit
