Critical

U.S. DOJ Charges 54 in ATM Jackpotting Scheme Using Ploutus Malware

The Hacker News
Actively Exploited

Overview

The U.S. Department of Justice has charged 54 individuals involved in a significant ATM jackpotting scheme that reportedly stole millions of dollars. This criminal operation utilized malware known as Ploutus to manipulate ATMs across the United States, causing them to dispense cash unlawfully. Many of those indicted are linked to Tren de Aragua, a criminal group based in Venezuela. The actions of these individuals not only affect financial institutions but also threaten the security and trust of ATM users nationwide. This case underscores the ongoing risks posed by sophisticated cybercrime networks that exploit vulnerabilities in financial systems.

Key Takeaways

  • Active Exploitation: This vulnerability is being actively exploited by attackers. Immediate action is recommended.
  • Affected Systems: Automated Teller Machines (ATMs), specifically those susceptible to Ploutus malware.
  • Action Required: Financial institutions should enhance ATM security measures, including regular software updates and monitoring for unusual transaction patterns.
  • Timeline: Disclosed on [date]

Original Article Summary

The U.S. Department of Justice (DoJ) this week announced the indictment of 54 individuals in connection with a multi-million dollar ATM jackpotting scheme. The large-scale conspiracy involved deploying malware named Ploutus to hack into automated teller machines (ATMs) across the U.S. and force them to dispense cash. The indicted members are alleged to be part of Tren de Aragua (TdA, Spanish for

Impact

Automated Teller Machines (ATMs), specifically those susceptible to Ploutus malware.

Exploitation Status

This vulnerability is confirmed to be actively exploited by attackers in real-world attacks. Organizations should prioritize patching or implementing workarounds immediately.

Timeline

Disclosed on [date]

Remediation

Financial institutions should enhance ATM security measures, including regular software updates and monitoring for unusual transaction patterns.

Additional Information

This threat intelligence is aggregated from trusted cybersecurity sources. For the most up-to-date information, technical details, and official vendor guidance, please refer to the original article linked below.

Related Topics: This incident relates to Exploit, Malware.

Related Coverage

Federal agencies recommend cyber controls, independent testing for frontier AI systems

CyberScoop

Federal agencies have released new cybersecurity guidance aimed at improving the security of AI systems during testing phases, particularly within sandbox environments. While the recommendations are voluntary, they provide a detailed framework for implementing robust cyber controls and conducting independent assessments of frontier AI systems. This guidance is particularly relevant as organizations increasingly experiment with advanced AI technologies, which can introduce unique vulnerabilities if not managed properly. Ensuring these systems are tested securely helps mitigate potential risks before they are deployed in real-world applications. The move reflects a growing recognition of the need for proactive security measures in the rapidly evolving field of artificial intelligence.

Oct 17, 2026

Critical BlockStrap flaw lets hackers run code on Magento servers

BleepingComputer

Researchers have identified a severe vulnerability, designated as CVE-2026-103849, affecting Magento and Adobe Commerce platforms. This flaw could allow attackers to execute arbitrary PHP code on online store servers, posing a significant risk to e-commerce sites using these systems. If exploited, the vulnerability could lead to unauthorized access, data breaches, or even full server compromise. Store owners and administrators are urged to take immediate action to protect their systems. Given the popularity of Magento and Adobe Commerce, this vulnerability could affect a large number of online retailers, making it crucial for them to address this issue promptly.

Oct 16, 2026

Fake Claude, ChatGPT Attacks Surge, Putting Developers at Risk

darkreading

Recent campaigns have seen a surge in attacks that impersonate well-known AI brands like ChatGPT. These attacks often employ tactics similar to those used by ClickFix, targeting unsuspecting employees in various enterprises. The goal is to trick users into providing sensitive information or downloading malicious software. This rise in impersonation not only puts individual employees at risk but also threatens the security of entire organizations. As these attackers exploit the popularity of AI tools, it's crucial for companies to educate their staff about recognizing and avoiding such scams.

Oct 16, 2026

Have a Meta business account? You’re consenting to AI scraping now, legal experts say

news – ZDNET

Meta users with business accounts are now consenting to AI scraping of their data, according to legal experts. This means that any data shared through these accounts can be collected and used by AI systems without an option to opt-out. The implications are significant for businesses that rely on Meta’s platforms, as sensitive information could be at risk of being used in ways they did not intend. Users need to be aware of this policy change, as it raises concerns about privacy and data security. With no clear way to prevent this data collection, businesses must consider how this affects their operations and customer trust.

Oct 16, 2026

Researchers Demonstrate OpenBSD Root Exploit Chaining 37-Year-Old Shared-Memory Bug

The Hacker News

Researchers have discovered a serious local privilege escalation vulnerability in OpenBSD 7.9, which allows attackers to gain root access by exploiting a 37-year-old integer overflow alongside a newer kernel flaw. This exploit successfully bypasses several security measures, including OpenBSD's kernel-address randomization and hardware protections like SMAP and SMEP. The security firm Calif, which identified and reported these vulnerabilities, has shared a detailed writeup and proof-of-concept code. This incident raises concerns for users of OpenBSD, as it highlights potential weaknesses in the operating system's defenses that could be exploited by malicious actors. Users and system administrators are advised to stay informed and monitor for patches or updates related to these vulnerabilities.

Oct 16, 2026

Prolific Chinese espionage group exploits BeyondTrust zero-day

CyberScoop

A Chinese espionage group known as Armory Castle, or UNC5221, has been exploiting a zero-day vulnerability in BeyondTrust software, marking their first known attack with this method nearly seven weeks ago. This group has a history of targeting customers of Ivanti and Citrix, indicating a pattern of focusing on software vulnerabilities to gain unauthorized access. The exploitation of this zero-day poses significant risks to organizations using BeyondTrust products, potentially allowing attackers to steal sensitive information or disrupt operations. Companies using this software should take immediate action to assess their systems for vulnerabilities and apply any available patches. As cyber threats continue to evolve, awareness and proactive security measures are crucial for safeguarding sensitive data.

Oct 16, 2026