Threat Group Cards: A Threat Actor Encyclopedia
Archived: 2026-04-06 00:23:27 UTC
Home > List all groups > List all tools > List all groups using tool ATMSpitter
 Tool: ATMSpitter
Names ATMSpitter
Category Malware
Type ATM malware
Description
The ATMSpitter family consists of command-line tools designed to control the cash dispenser
of an ATM through function calls to either CSCWCNG.dll or MFSXFS.dll.
Both libraries are legitimate Windows drivers used to interact with the components of different
ATM models.
Information
<https://quoscient.io/reports/QuoINT_INTBRI_New_ATMSpitter.pdf>
<https://quoscient.io/reports/QuoINT_INTBRI_ATMSpitter_v2.pdf>
Malpedia <https://malpedia.caad.fkie.fraunhofer.de/details/win.atmspitter>
Last change to this tool card: 23 April 2020
Download this tool card in JSON format
All groups using tool ATMSpitter
Changed Name Country Observed
APT groups
  Cobalt Group 2016-Oct 2019
1 group listed (1 APT, 0 other, 0 unknown)
Source: https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=e0bf2c15-80da-4779-af76-708f9d5764eb
https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=e0bf2c15-80da-4779-af76-708f9d5764eb
Page 1 of 1