Overview of Ploutus and Tyupkin ATM Malware

[Papa Carder]

Ploutus and Tyupkin are two prominent families of ATM malware designed for "jackpotting" attacks, where criminals force ATMs to dispense cash without a legitimate transaction, card, or PIN. Both require physical access to the ATM for installation and exploit the eXtensions for Financial Services (XFS) middleware, a standard API that interfaces software with ATM hardware like cash dispensers. Ploutus emerged earlier and has evolved into more sophisticated variants, while Tyupkin (also known as Padpin in earlier forms) focuses on stealthy, time-restricted operations. These malware families highlight the convergence of physical crime and cyber threats, with losses in the millions globally.

Key differences stem from their origins, evolution, and operational tactics. Ploutus originated in Latin America and has seen ongoing development, making it more adaptable across vendors. Tyupkin, rooted in Eastern Europe, emphasizes nighttime operations and anti-detection features but appears less actively evolved in recent years (as of 2026).

Detailed Comparison​

Aspect	Ploutus	Tyupkin (aka Padpin)
Discovery Year & Origin	First identified in 2013 in Mexico (Latin America). Spread to other regions, with variants still active in 2025-2026 US incidents.	First variant (Padpin) in 2014; full Tyupkin disclosed later that year in Eastern Europe. Primarily targeted Europe and Southeast Asia.
Targeted ATMs & Vendors	Initially NCR-specific; later variants (e.g., Ploutus.C/D) support multi-vendor via KAL Kalignite framework. Runs on Windows (XP/7/8/10).	NCR ATMs with McAfee Solidcore protection. Also Windows-based, often XP.
Installation Method	Physical access: Remove/replace hard drive, USB boot, or external keyboard attachment. Variants like Ploutus.B add internal mobile phone for SMS control.	Physical access: Bootable CD-ROM inserted after picking locks or gaining cabinet entry. Disables network connections post-install to prevent remote shutdown.
Activation & Control	Activation via 8-digit code (hardware ID-based, valid 24 hours). Control through external keyboard, SMS (Ploutus.B), or remote management (Ploutus.D). F-keys (e.g., F3) trigger dispense.	Hooks PIN pad for control. Requires session keys (challenge-response) and secondary random code from remote algorithm. Active only Sundays/Mondays 1-5 AM for stealth.
Core Functionality	Dispenses cash from cassettes without transaction. Variants add remote control, UI for status (cassette counts), and self-deletion. Can kill security processes.	Dispenses cash; also logs card/PIN data in variants. Disables anti-malware and networks. Time-restricted to avoid detection during business hours.
Obfuscation & Technical Details	.NET-based, heavily obfuscated (e.g., .NET Reactor with string encryption, method proxying). Modular design for cross-vendor support.	Based on MSIL (Microsoft Intermediate Language); less emphasis on obfuscation in reports, but uses whitelisting bypass and infinite loops for persistence.
Evolution & Variants	Highly evolved: Ploutus (2013), Ploutus.B (SMS), Ploutus.C (multi-vendor), Ploutus.D (remote). Still active in 2026 with links to groups like Tren de Aragua.	Padpin (2014) evolved into Tyupkin. Fewer reported variants; some card-skimming additions. Less mention of recent activity post-2015.
Impact & Losses	Millions stolen; e.g., Ploutus.D linked to $40M+ in 2025 US cases. Used in coordinated gang operations.	Millions from Europe/Asia; over 50 ATMs infected initially. Focused on "money mules" for cash-outs.
Mitigation Challenges	Harder to detect due to remote features; requires physical security upgrades (tamper sensors, unique keys).	Time restrictions make it stealthy but predictable; countered by monitoring off-hours activity and boot device restrictions.

Similarities​

• Attack Vector: Both rely on physical compromise (e.g., cabinet access) and exploit XFS for direct hardware control, bypassing bank networks.
• Purpose: Primarily jackpotting (cash dispense); some variants add card/PIN skimming.
• OS Dependency: Target outdated Windows versions (e.g., XP), common in legacy ATMs.
• Criminal Tactics: Use activation codes/session keys to limit access (e.g., for mules vs. leaders). Often part of organized crime, with Ploutus inspiring Tyupkin-like evolutions.
• Global Spread: Started regionally but spread internationally, influencing other malware like GreenDispenser or Suceful.

Key Differences in Context​

Ploutus represents a more "innovative" and adaptable threat, pioneering SMS control and multi-vendor support, which has kept it relevant into 2026. Tyupkin, while effective, prioritizes operational stealth (e.g., nighttime limits) but has seen less evolution, possibly due to increased ATM security post-2014 disclosures. Both underscore vulnerabilities in aging ATM infrastructure, with experts noting a spike in such attacks as banks delay upgrades. In 2026, Ploutus variants remain a top concern in US/EU, while Tyupkin incidents have waned but inspired similar timed-restriction tactics in newer malware.

For mitigations, focus on physical barriers, software whitelisting, and regular firmware updates to counter both. If you need deeper analysis on a specific variant or related malware, let me know!