North Korean hackers have been tampering with ATMs across the world to steal millions in cash, according to US investigators.
On Tuesday, the FBI and the Department of Homeland Security issued a technical alert blaming the North Korean government for perpetrating an ATM cash-out scheme that has hit banks in Asia and Africa.
The attacks, which began late in 2016, have allowed the hackers to simultaneously withdraw cash from ATMs located in dozens of different countries, federal investigators claim. In total, "tens of millions of dollars" may have been stolen, the alert warns.
The scheme works by tampering with the special payment servers banks use to authorize cash withdrawals. According to US investigators, the North Koreans hackers secretly reconfigured these servers to issue fraudulent, but legitimate-looking cash withdrawal requests.
How the hackers have been breaking into these servers isn't known. But federal investigators suspect the hackers send phishing emails to bank employees to trick them into installing malware on their computers. The hackers can then infiltrate the bank's network and identify the vulnerable payment servers.
The US government issued the alert almost a month after it officially charged a 34-year-old programmer for being a member of a North Korean state-sponsored hacking group that's been targeting banks across the globe. The programmer, Park Jin Hyok, also played a role in the 2014 Sony Pictures hack and the WannaCry ransomware outbreak that terrorized Windows computers, the US Justice Department claims.
However, last month's indictment was largely a symbolic action. Park Jin Hyok remains at large. The cybersecurity firm FireEye is also warning that North Korean hackers have been undeterred and continue to target financial institutions. On Wednesday, the company issued a report claiming that North Korean hackers have attempted to steal at least $1.1 billion over the last four years.
So far, US investigators have found no evidence of the ATM cash-out scheme hitting financial institutions in the US. Their technical alert contains tips on how banks can ward off the ATM hacking threat, and how to check to see if they've been attacked.