Dozens more are charged in Ploutus ATM jackpotting conspiracy

The Department of Justice on Monday announced a federal grand jury indictment charging 31 people for participating in a conspiracy to steal millions from ATMs by deploying Ploutus malware.

The Justice Department has said that between February 2024 and December 2025, the gang stole at least $5.4 million from at least 63 ATMs, most of which belonged to credit unions.

The scheme was complex and required gang members to surveil potential target ATMs and then open the doors of machines they decided to hit to see if alarms went off.

If law enforcement did not respond to the ATMs being opened, gang members would then allegedly take out the ATMs’ hard drives and replace them with ones equipped with Ploutus or would connect thumb drives that unleashed the malware.

The malware was able to order the ATMs to dispense cash by overcoming their security systems.

The Department of Justice has said some of the defendants are illegal immigrants who are members of the Venezuelan gang Tren de Aragua (TdA). The charges brought include conspiracy to commit bank fraud, conspiracy to commit bank burglary and computer fraud, bank fraud, bank burglary and damage to computers.

Fifty-six others were charged with participating in the “ATM jackpotting” scheme last month. 

Experts and U.S. agencies have cautioned the public about Ploutus malware for almost ten years and Google researchers have called it “one of the most advanced ATM malware families” they’ve seen. 

Symantec first detected Ploutus ATM malware in 2013 and it has frequently evolved since then.

The first known ATM jackpotting spree using Ploutus occurred in Mexico in 2013. A variety of ATM vendors have proven vulnerable to the malware, including Diebold Nixdorf and Kalignite Platform.

Get more insights with the

Recorded Future

Intelligence Cloud.

Learn more.

No previous article

No new articles

Suzanne Smalley

Suzanne Smalley

is a reporter covering digital privacy, surveillance technologies and cybersecurity policy for The Record. She was previously a cybersecurity reporter at CyberScoop. Earlier in her career Suzanne covered the Boston Police Department for the Boston Globe and two presidential campaign cycles for Newsweek. She lives in Washington with her husband and three children.

 

Total
0
Shares
Previous Post

WhatsApp Rolls Out Lockdown-Style Security Mode to Protect Targeted Users From Spyware

Next Post

Chinese money launderers moved more than $16 billion of illicit crypto in 2025, report finds

Related Posts

CISA Flags Actively Exploited GeoServer XXE Flaw in Updated KEV Catalog

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Thursday added a high-severity security flaw impacting OSGeo GeoServer to its Known Exploited Vulnerabilities (KEV) catalog, based on evidence of active exploitation in the wild. The vulnerability in question is CVE-2025-58360 (CVSS score: 8.2), an unauthenticated XML External Entity (XXE) flaw that affects all versions prior to
Read More

Google to Shut Down Dark Web Monitoring Tool in February 2026

Google has announced that it's discontinuing its dark web report tool in February 2026, less than two years after it was launched as a way for users to monitor if their personal information is found on the dark web. To that end, scans for new dark web breaches will be stopped on January 15, 2026, and the feature will cease to exist effective February 16, 2026. "While the report offered general
Read More