Cyber Incident Victim: Al Rajhi Bank
Date:
Oct 2014
Location:
Malaysia
Summary
A Latin American criminal group exploited malware named "ulssm.exe" to compromise ATMs across multiple banks in Malaysia, including Al Rajhi Bank, by physically accessing the machines' processing centers with compact discs that forced system reboots. The attackers stole approximately $1.2 million from 17 ATMs through sequential cash withdrawals, with CCTV footage capturing 2-3 suspects during the operations. Law enforcement recovered one compromised ATM card and confirmed no customer data was breached due to the system reset, while investigations indicated the perpetrators remained in the country at the time of reporting.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 1 technique |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
In October 2014, a Latin American criminal group executed a coordinated physical and cyber attack against 17 ATMs across multiple Malaysian banks, including Al Rajhi Bank, United Overseas Bank, Affin Bank, and Bank of Islam. The attackers physically accessed the top panels of targeted ATMs without using keys, inserted a compact disc containing the "ulssm.exe" malware into the machines' processing centers, and forced system reboots that compromised ATM controls. CCTV footage confirmed 2-3 Latin American males conducting sequential cash withdrawals from the compromised machines. The malware-enabled theft resulted in losses exceeding $1.2 million USD across the affected banks. Law enforcement from Bukit Aman Commercial Crime Investigation Department and Selangor Commercial Crime Investigation Department confirmed the attackers exploited the reboot process to bypass standard security protocols, though investigators emphasized no customer data was exposed due to the ATMs reverting to default settings during the breach.
Malaysian police recovered at least one ATM card used in the thefts during their investigation, which remained active as of the initial reports. Forensic analysis determined the malware manipulated ATM dispensing mechanisms while avoiding transaction record alterations. Authorities publicly disclosed the incident on October 1, 2014, through Bernama state media, with Bukit Aman's Comm Datuk Mortadza Nazarene confirming the operational details of the attacks. Investigators assessed the perpetrators remained in Malaysia based on transaction timelines and CCTV evidence, though no arrests were immediately reported. The incident exclusively impacted ATM hardware and cash reserves, with no secondary compromise of banking networks or customer accounts identified during the initial response phase.