U.S. DOJ Charges 54 in ATM Jackpotting Scheme Using Ploutus Malware

The Hacker News
Actively Exploited

Overview

The U.S. Department of Justice has charged 54 individuals involved in a significant ATM jackpotting scheme that reportedly stole millions of dollars. This criminal operation utilized malware known as Ploutus to manipulate ATMs across the United States, causing them to dispense cash unlawfully. Many of those indicted are linked to Tren de Aragua, a criminal group based in Venezuela. The actions of these individuals not only affect financial institutions but also threaten the security and trust of ATM users nationwide. This case underscores the ongoing risks posed by sophisticated cybercrime networks that exploit vulnerabilities in financial systems.

Key Takeaways

  • Active Exploitation: This vulnerability is being actively exploited by attackers. Immediate action is recommended.
  • Affected Systems: Automated Teller Machines (ATMs), specifically those susceptible to Ploutus malware.
  • Action Required: Financial institutions should enhance ATM security measures, including regular software updates and monitoring for unusual transaction patterns.
  • Timeline: Disclosed on [date]

Original Article Summary

The U.S. Department of Justice (DoJ) this week announced the indictment of 54 individuals in connection with a multi-million dollar ATM jackpotting scheme. The large-scale conspiracy involved deploying malware named Ploutus to hack into automated teller machines (ATMs) across the U.S. and force them to dispense cash. The indicted members are alleged to be part of Tren de Aragua (TdA, Spanish for

Impact

Automated Teller Machines (ATMs), specifically those susceptible to Ploutus malware.

Exploitation Status

This vulnerability is confirmed to be actively exploited by attackers in real-world attacks. Organizations should prioritize patching or implementing workarounds immediately.

Timeline

Disclosed on [date]

Remediation

Financial institutions should enhance ATM security measures, including regular software updates and monitoring for unusual transaction patterns.

Additional Information

This threat intelligence is aggregated from trusted cybersecurity sources. For the most up-to-date information, technical details, and official vendor guidance, please refer to the original article linked below.

Related Topics: This incident relates to Exploit, Malware.

Related Coverage

Report: Data extortion intrusions spike

SCM feed for Latest

In 2024, cyberattacks involving data extortion surged to 6,800 incidents, marking a significant 63% increase from the previous year. This rise has been largely driven by the intensified activities of ransomware groups such as Qilin, Sp1d3r Hunters, and Clop. These groups are known for stealing sensitive data and then threatening to release it unless a ransom is paid. This trend poses serious risks to organizations across various sectors as they face increasing pressure to protect their data and respond to extortion demands. Companies must enhance their cybersecurity measures to mitigate these risks and safeguard their sensitive information from being exploited by cybercriminals.

Feb 13, 2026

Toll of Georgia health firm hack exceeds 620K

SCM feed for Latest

ApolloMD, a major healthcare firm based in Georgia with operations across the U.S., disclosed a significant data breach affecting over 626,000 patients. The incident, which occurred in May, was attributed to the Qilin ransomware group. Compromised information includes sensitive data, which raises serious concerns about patient privacy and potential identity theft. As healthcare organizations increasingly face cyber threats, this breach serves as a troubling reminder of the vulnerabilities within the sector. Patients and providers alike need to be vigilant about safeguarding personal information and responding to potential fallout from such attacks.

Feb 13, 2026

UK government faces IT hurdles in preventing sensitive data leaks

SCM feed for Latest

The UK government's Science, Innovation and Technology Committee recently questioned ministers about the challenges of preventing sensitive data leaks, particularly in light of a recent incident involving the Ministry of Defence (MoD). In this case, sensitive information was accidentally exposed, putting Afghan informants at risk. This incident raises serious concerns about data security practices within government departments. The committee is focused on ensuring that such lapses do not occur again, especially given the potential dangers to individuals who have assisted UK forces. The discussion highlights the urgent need for better safeguards to protect sensitive data in government systems.

Feb 13, 2026

Ivanti EPMM Zero-Day Bugs Spark Exploit Frenzy — Again

darkreading

Recent zero-day vulnerabilities in Ivanti's Endpoint Manager Mobile (EPMM) have sparked renewed concern among cybersecurity experts. These flaws, which can be exploited by attackers, could potentially compromise sensitive data in mobile devices managed by the software. Organizations using EPMM must act quickly to secure their systems, as these vulnerabilities are already being exploited in the wild. Experts are urging a shift away from simply applying patches and towards more robust security measures, including better authentication controls and reducing unnecessary public interfaces. The urgency of the situation emphasizes the need for businesses to prioritize security and stay updated with the latest patches and practices.

Feb 12, 2026

Critical BeyondTrust RCE flaw now exploited in attacks, patch now

BleepingComputer

A serious vulnerability has been discovered in BeyondTrust Remote Support and Privileged Remote Access appliances, allowing attackers to execute code remotely without authentication. This flaw has become a target for exploitation after a proof-of-concept (PoC) was made publicly available. Organizations using these systems should be particularly vigilant, as the flaw can lead to unauthorized access and potential data breaches. BeyondTrust has released patches to address this issue, and it’s crucial for users to apply these updates promptly to protect their systems. The urgency of this situation highlights the need for proactive security measures in remote access technologies.

Feb 12, 2026

Gone With the Shame: One in Two Americans Are Reluctant to Talk About Romance Scam Incidents

darkreading

As Valentine's Day approaches, a new report reveals that men are nearly twice as likely as women to fall victim to romance scams. These scams typically involve fraudsters posing as potential romantic partners online, often leading to significant financial losses for victims. The reluctance to discuss these incidents is prevalent, with many individuals feeling ashamed or embarrassed about being scammed. This silence can hinder awareness and prevention efforts, making it crucial for people to openly share their experiences. Given the emotional and financial toll these scams can take, men should be particularly vigilant this Valentine's Day to avoid falling prey to such deceitful tactics.

Feb 12, 2026