Thai cyber police have arrested a 50-year-old Bulgarian man suspected of posing as a technician to tamper with ATMs across Bangkok and nearby provinces, disrupting services at over a dozen machines since March 2025.
A Bulgarian national has been apprehended by Thai cyber police for allegedly disguising himself as an ATM repair technician and installing malicious devices in at least 13 ATMs, leading to disruptions in banking operations across Bangkok, Nonthaburi, Pathum Thani, and Chonburi provinces.
The arrest was made public during a press conference held by the Cyber Crime Investigation Bureau on 28 May 2025. Officials explained that the man, identified only as Ivan, allegedly accessed ATM control panels using a master key while dressed in a technician’s uniform. According to authorities, the suspect then replaced original data transmission cables with modified versions containing a virus that interfered with ATM functionality.
The devices were found to include a malware program known as “jackpot,” which was transmitted via SIM cards embedded in the cables. This software disrupted ATM operations, including cash dispensing mechanisms and electrical systems, raising concerns over broader economic implications.
Initial alerts came in March, when banks began reporting cases of suspected tampering. Investigators reviewed surveillance footage and tracked the suspects’ movements, which revealed that a group of 2–3 foreign individuals, using a rented white Honda City sedan, were involved. This led police to secure court-issued warrants for search and arrest.
Authorities conducted a raid on a high-end residential compound in the Bang Phlap area of Pak Kret district, Nonthaburi province, on 27 May. Ivan was taken into custody during the operation. Officers also seized computer equipment and several modified cables believed to contain digital evidence linked to the case.
Ivan has been charged with multiple offenses, including conspiracy to commit theft at night, unauthorized interception of computer data, causing disruption to computer systems, and endangering systems tied to national security and economic stability. He has denied involvement in the malware attacks, claiming he only opened the ATM panels and was not aware of further illegal actions.
The Cyber Crime Investigation Bureau noted that the arrest was part of a wider effort to dismantle an international group targeting financial systems in Thailand. Officials stated that investigations are ongoing to identify and apprehend additional suspects involved in the operation.
