Cyber Incident Victim: United Overseas Bank
Date:
Oct 2014
Location:
Malaysia
Summary
A Latin American criminal gang stole approximately $1.2 million by hacking ATMs across multiple Malaysian banks, including United Overseas Bank, through physical manipulation and malware deployment. The attackers opened ATM panels without keys, inserted discs containing "ulssm.exe" malware to force system reboots, enabling unauthorized cash withdrawals while avoiding customer data compromise due to the reset. Authorities recovered one fraudulent ATM card and suspect the perpetrators remain in the country, with ongoing investigations focusing on the coordinated attacks involving 2-3 individuals per machine captured on surveillance footage.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 1 technique |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
In October 2014, a Latin American criminal group executed coordinated attacks on automated teller machines (ATMs) across Malaysia, compromising 17 ATMs affiliated with United Overseas Bank, Affin Bank, Al Rajhi Bank, and Bank of Islam. The attackers physically accessed the targeted ATMs by opening the top panel of each machine without using a key, bypassing physical security measures. They inserted a compact disc containing the "ulssm.exe" malware into the ATM's processing center, triggering a system reboot that enabled unauthorized control over the devices. Closed-circuit television footage confirmed that 2-3 Latin American males conducted sequential cash withdrawals from the compromised ATMs following the malware installation. The group successfully stole approximately $1.2 million through these operations, with police later recovering one ATM card used during the thefts. Law enforcement confirmed the malware forced ATMs to revert to default settings but noted no customer data compromise occurred due to this system reset.
Bukit Aman Commercial Crime Investigation Department led the investigation under Comm Datuk Mortadza Nazarene, coordinating with Selangor Commercial Crime Investigation Department authorities. Police examined the malware's functionality and the physical breach methodology while reviewing CCTV evidence to identify suspects. Investigators determined the perpetrators remained in Malaysia following the attacks and continued active inquiries to locate them. The incident exclusively impacted ATM hardware and cash reserves without affecting core banking systems or customer databases. Financial institutions collaborated with law enforcement to assess physical security vulnerabilities exposed by the attackers' ability to open ATM panels without legitimate keys. No public statements from the affected banks regarding financial reimbursements or long-term security changes were documented in the available report as of the investigation's active phase.