Dozens more are charged in Ploutus ATM jackpotting conspiracy

The Department of Justice on Monday announced a federal grand jury indictment charging 31 people for participating in a conspiracy to steal millions from ATMs by deploying Ploutus malware.

The Justice Department has said that between February 2024 and December 2025, the gang stole at least $5.4 million from at least 63 ATMs, most of which belonged to credit unions.

The scheme was complex and required gang members to surveil potential target ATMs and then open the doors of machines they decided to hit to see if alarms went off.

If law enforcement did not respond to the ATMs being opened, gang members would then allegedly take out the ATMs’ hard drives and replace them with ones equipped with Ploutus or would connect thumb drives that unleashed the malware.

The malware was able to order the ATMs to dispense cash by overcoming their security systems.

The Department of Justice has said some of the defendants are illegal immigrants who are members of the Venezuelan gang Tren de Aragua (TdA). The charges brought include conspiracy to commit bank fraud, conspiracy to commit bank burglary and computer fraud, bank fraud, bank burglary and damage to computers.

Fifty-six others were charged with participating in the “ATM jackpotting” scheme last month. 

Experts and U.S. agencies have cautioned the public about Ploutus malware for almost ten years and Google researchers have called it “one of the most advanced ATM malware families” they’ve seen. 

Symantec first detected Ploutus ATM malware in 2013 and it has frequently evolved since then.

The first known ATM jackpotting spree using Ploutus occurred in Mexico in 2013. A variety of ATM vendors have proven vulnerable to the malware, including Diebold Nixdorf and Kalignite Platform.

Get more insights with the

Recorded Future

Intelligence Cloud.

Learn more.

No previous article

No new articles

Suzanne Smalley

Suzanne Smalley

is a reporter covering digital privacy, surveillance technologies and cybersecurity policy for The Record. She was previously a cybersecurity reporter at CyberScoop. Earlier in her career Suzanne covered the Boston Police Department for the Boston Globe and two presidential campaign cycles for Newsweek. She lives in Washington with her husband and three children.

 

Total
0
Shares
Previous Post

WhatsApp Rolls Out Lockdown-Style Security Mode to Protect Targeted Users From Spyware

Next Post

Chinese money launderers moved more than $16 billion of illicit crypto in 2025, report finds

Related Posts

PromptSpy Android Malware Abuses Gemini AI to Automate Recent-Apps Persistence

Cybersecurity researchers have discovered what they say is the first Android malware that abuses Gemini, Google's generative artificial intelligence (AI) chatbot, as part of its execution flow and achieves persistence. The malware has been codenamed PromptSpy by ESET. The malware is equipped to capture lockscreen data, block uninstallation efforts, gather device information, take screenshots,
Read More

CSA Issues Alert on Critical SmarterMail Bug Allowing Remote Code Execution

The Cyber Security Agency of Singapore (CSA) has issued a bulletin warning of a maximum-severity security flaw in SmarterTools SmarterMail email software that could be exploited to achieve remote code execution. The vulnerability, tracked as CVE-2025-52691, carries a CVSS score of 10.0. It relates to a case of arbitrary file upload that could enable code execution without requiring any
Read More