Dozens more are charged in Ploutus ATM jackpotting conspiracy

The Department of Justice on Monday announced a federal grand jury indictment charging 31 people for participating in a conspiracy to steal millions from ATMs by deploying Ploutus malware.

The Justice Department has said that between February 2024 and December 2025, the gang stole at least $5.4 million from at least 63 ATMs, most of which belonged to credit unions.

The scheme was complex and required gang members to surveil potential target ATMs and then open the doors of machines they decided to hit to see if alarms went off.

If law enforcement did not respond to the ATMs being opened, gang members would then allegedly take out the ATMs’ hard drives and replace them with ones equipped with Ploutus or would connect thumb drives that unleashed the malware.

The malware was able to order the ATMs to dispense cash by overcoming their security systems.

The Department of Justice has said some of the defendants are illegal immigrants who are members of the Venezuelan gang Tren de Aragua (TdA). The charges brought include conspiracy to commit bank fraud, conspiracy to commit bank burglary and computer fraud, bank fraud, bank burglary and damage to computers.

Fifty-six others were charged with participating in the “ATM jackpotting” scheme last month. 

Experts and U.S. agencies have cautioned the public about Ploutus malware for almost ten years and Google researchers have called it “one of the most advanced ATM malware families” they’ve seen. 

Symantec first detected Ploutus ATM malware in 2013 and it has frequently evolved since then.

The first known ATM jackpotting spree using Ploutus occurred in Mexico in 2013. A variety of ATM vendors have proven vulnerable to the malware, including Diebold Nixdorf and Kalignite Platform.

Get more insights with the

Recorded Future

Intelligence Cloud.

Learn more.

No previous article

No new articles

Suzanne Smalley

Suzanne Smalley

is a reporter covering digital privacy, surveillance technologies and cybersecurity policy for The Record. She was previously a cybersecurity reporter at CyberScoop. Earlier in her career Suzanne covered the Boston Police Department for the Boston Globe and two presidential campaign cycles for Newsweek. She lives in Washington with her husband and three children.

 

Total
0
Shares
Previous Post

WhatsApp Rolls Out Lockdown-Style Security Mode to Protect Targeted Users From Spyware

Next Post

Chinese money launderers moved more than $16 billion of illicit crypto in 2025, report finds

Related Posts

Model Security Is the Wrong Frame – The Real Risk Is Workflow Security

As AI copilots and assistants become embedded in daily work, security teams are still focused on protecting the models themselves. But recent incidents suggest the bigger risk lies elsewhere: in the workflows that surround those models. Two Chrome extensions posing as AI helpers were recently caught stealing ChatGPT and DeepSeek chat data from over 900,000 users. Separately, researchers
Read More

North Korea-Linked Hackers Target Developers via Malicious VS Code Projects

The North Korean threat actors associated with the long-running Contagious Interview campaign have been observed using malicious Microsoft Visual Studio Code (VS Code) projects as lures to deliver a backdoor on compromised endpoints. The latest finding demonstrates continued evolution of the new tactic that was first discovered in December 2025, Jamf Threat Labs said. "This activity involved
Read More