Exposing Alice ATM Stealer: Infrastructure Mapping of a Financial Threat

Financial institutions remain top targets for cybercriminal groups focused on high-reward operations. One such malware family, Alice ATM Stealer, is designed specifically to compromise ATM systems, allowing attackers to dispense cash, bypassing legitimate banking processes.

Our security analysts have mapped the infrastructure behind a recent campaign involving Alice ATM Stealer, uncovering how cybercriminals structure, distribute, and manage these attacks. This mapping enables us to detect and disrupt malicious operations before they impact your organization.

Threat Overview

Alice ATM Stealer is a lightweight, modular malware strain built to interact directly with ATM hardware and vendor APIs. Its primary capabilities include:

• Unauthorized cash dispensing (“jackpotting”)
• Disabling network connections to avoid detection
• Manual or remote command execution via USB or remote access
• Stealth operation via service installation or fileless execution

While it lacks some advanced evasion techniques, Alice’s simplicity and direct targeting make it highly effective, especially in under-secured ATM environments.

Infrastructure Mapping Insight

Through our infrastructure analysis, we have identified:

• Command channels used for remote instructions and triggering ATM cashouts
• Malware distribution points, often disguised as bank service utilities
• Lateral movement patterns across financial networks
• Indicators of reuse across multiple financial institutions and regions

Our infrastructure threat intelligence enables rapid identification of related assets, revealing the broader ecosystem supporting ATM-targeting malware and empowering clients to act early.

IOC Table – Block Immediately

Organizations should integrate the following hashes into their endpoint and network security systems to detect and block known malware variants associated with the Alice ATM Stealer campaign.

Recommendations

To reduce exposure to ATM-targeted campaigns like Alice:

• Monitor and restrict USB and physical access to ATM devices
• Deploy endpoint protection with real-time execution prevention
• Segment ATM networks from internal IT systems
• Conduct regular audits of ATM software and firmware integrity
• Use IOC-based hunting to identify signs of initial compromise

How We Help

• Our Infrastructure Mapping Service provides:
• Full threat actor infrastructure visualizations
• IOC packages tailored for your environment
• Intelligence-led threat hunting support
• Early warning alerts for reused or mutated campaign infrastructure
• Expert guidance on mitigation and response

We deliver actionable intelligence that enables your team to prevent financial loss, preserve trust, and stay ahead of financially motivated threat actors.