BANGKOK — Thai Cyber Police have arrested a Bulgarian national suspected of posing as an ATM repair technician to install devices that disrupted the operations of at least 13 ATMs across Bangkok and surrounding provinces.
The Cyber Crime Investigation Bureau announced the arrest during a press conference on May 28th, with Deputy Commander Colonel Weerkwin Sermsrithanachai of the Technology Crime Investigation Division providing details of the operation.
In March, police received reports from financial institutions about suspicious individuals dressed as ATM technicians using master keys to access ATM panels. The suspects replaced internal data transmission cables and stole the original cables, causing damage to 13 ATMs across Bangkok, Nonthaburi, Pathum Thani provinces, and Sriracha district in Chonburi province, resulting in significant losses for financial institutions.
Police launched an urgent investigation, examining CCTV footage from incident locations and escape routes. The investigation revealed a group of 2-3 foreign nationals using a white Honda City rental car to commit the crimes.
Analysis of the replacement data cables revealed they contained a virus called “jackpot” that transmitted through internet signals from SIM cards installed within the cables. The virus disrupted ATM operations and electrical systems, causing cash withdrawal malfunctions and threatening the country’s economic security.
Following evidence collection, police obtained court warrants and searched a luxury housing estate in Bang Phlap subdistrict, Pak Kret district, Nonthaburi province. The operation led to the arrest of Ivan, a 50-year-old Bulgarian national, along with the seizure of stolen data cables and computer equipment believed to contain evidence related to the crimes.
Ivan faces multiple charges including; conspiracy to commit theft during nighttime, unauthorized electronic interception of computer data, disrupting computer system operations, and damaging computer systems related to national security, public safety, and economic stability.
The Bulgarian suspect has denied all charges, claiming that while the equipment found in the residence belongs to him, his role was limited to opening ATMs and he did not participate in other criminal activities.
Police have remanded the suspect for further legal proceedings and stated they are actively pursuing other members of the criminal group involved in this operation.
_____________
