Bulgarian man arrested for allegedly tampering with 13 ATMs in Bangkok and suburbs

Bulgarian man arrested for allegedly planting devices in 13 ATMs across Bangkok to steal user data via SIM-equipped cables and “jackpot” virus.


Cybercrime police have arrested a Bulgarian national for allegedly installing data-trapping devices in 13 ATM machines across Bangkok and Nonthaburi, in a suspected attempt to steal sensitive banking information from users.


Arrest Announced by Cyber Crime Investigation Division


The Cyber Crime Investigation Division 2 announced the arrest of Ivan Valchev, 50, at its headquarters on Wednesday. Valchev was apprehended on Tuesday at a luxury residence in Pak Kret district, Nonthaburi, under an arrest warrant issued by the Criminal Court on 26 May.

Modified Cables Allegedly Used to Disrupt ATM Operations


According to Police Major General Siriwat Deepor, commander of the division, Valchev allegedly removed the original data cables from 13 ATMs and replaced them with modified cables embedded with SIM cards. These were allegedly used to plant a "jackpot" virus into the banking systems, which disrupted the normal operation of the machines and prevented customers from withdrawing money.


Siriwat said the attack posed a serious threat to the country’s financial security.

Devices May Have Stolen ATM User Data via SIM Cards


Cybersecurity experts suspect the implanted devices may have been designed to intercept sensitive data entered by ATM users. The SIM cards could then have transmitted the stolen data to email accounts controlled by hackers, who would use it to access victims' bank accounts.


Suspects Disguised as Technicians to Access ATMs


Banks had earlier alerted cybercrime police in March about criminals posing as technicians to access ATM systems. Using what appeared to be a master key, the suspects opened the control panels of ATMs located in Bangkok, Nonthaburi, Pathum Thani, and Chonburi.


Surveillance Footage Leads to Suspect Identification


Security camera footage showed two to three individuals tampering with ATMs and arriving in a white Honda City. Police traced the vehicle to a rental company, which identified Valchev as the person who had rented the car.


Seized Equipment and Ongoing Investigation


During the raid, police seized notebook computers, numerous data cables, and electronic devices. While Valchev admitted ownership of the equipment, he denied involvement in any criminal activity.
Police are continuing their investigation to identify and locate Valchev’s accomplices.

Bulgarian man arrested for allegedly tampering with 13 ATMs in Bangkok and suburbs

The key part, excuse the pun:

Quote:

---

Using what appeared to be a master key, the suspects opened the control panels of ATMs located in Bangkok, Nonthaburi, Pathum Thani, and Chonburi.

---

strange that a foreigner was able to tamper with these machines without being challenged by thais. unless i suppose he had thai partners.

i never use ATM machines unless they are located inside the premises of a bank.

those standalone jobs outside 7/11s and even some of the wall mounted ones don't seem so secure to me.

Quote:

---

Originally Posted by taxexile

strange that a foreigner was able to tamper with these machines without being challenged by thais. unless i suppose he had thai partners.

i never use ATM machines unless they are located inside the premises of a bank.

those standalone jobs outside 7/11s and even some of the wall mounted ones don't seem so secure to me.

---

The lower the traffic, the easier to install skimming devices.

But this is lot more than that.

Quote:

---

Originally Posted by harrybarracuda

But this is lot more than that.

---

in what way?

Quote:

---

The lower the traffic, the easier to install skimming devices.

---

do you mean its easier to fix a device on an in-bank machine than one outside?

Quote:

---

Originally Posted by taxexile

i never use ATM machines unless they are located inside the premises of a bank.

those standalone jobs outside 7/11s and even some of the wall mounted ones don't seem so secure to me.

---

It is possible now to use your phone to withdraw money from an ATM. No need for a card. No way to skim.

I think that from the article this would also compromise your account even if you were not using your card at the ATM

they seem to have placed an intercept device on the communications cables and via a sim card I imagine they transmitted the data to themselves

but the jackpot "virus" attack does not seem to steal money from accounts - it manipulates the ATM software to spit out all the cash when a code is inputted - so maybe with this communications cable they intended to remotely change the ATM software
Jackpotting Attacks Are Back - But Banks Can Fight Back

Quote:

---

Originally Posted by taxexile

in what way?

do you mean its easier to fix a device on an in-bank machine than one outside?

---

No, from the point of view that skimmers are normally easy to spot. This most definitely isn't.

I'm just amazed that these things can be opened by a master key you can buy on the interwebs, when banks can buy machine specific locks.

WTF are they thinking?

Quote:

---

WTF are they thinking?

---

it's thailand, they are not thinking.