U.S. DOJ Charges 54 in ATM Jackpotting Scheme Using Ploutus Malware

The Hacker News

December 20, 2025 at 1:48 PM

Actively Exploited

Overview

The U.S. Department of Justice has charged 54 individuals involved in a significant ATM jackpotting scheme that reportedly stole millions of dollars. This criminal operation utilized malware known as Ploutus to manipulate ATMs across the United States, causing them to dispense cash unlawfully. Many of those indicted are linked to Tren de Aragua, a criminal group based in Venezuela. The actions of these individuals not only affect financial institutions but also threaten the security and trust of ATM users nationwide. This case underscores the ongoing risks posed by sophisticated cybercrime networks that exploit vulnerabilities in financial systems.

Key Takeaways

Active Exploitation: This vulnerability is being actively exploited by attackers. Immediate action is recommended.
Affected Systems: Automated Teller Machines (ATMs), specifically those susceptible to Ploutus malware.
Action Required: Financial institutions should enhance ATM security measures, including regular software updates and monitoring for unusual transaction patterns.
Timeline: Disclosed on [date]

Original Article Summary

The U.S. Department of Justice (DoJ) this week announced the indictment of 54 individuals in connection with a multi-million dollar ATM jackpotting scheme. The large-scale conspiracy involved deploying malware named Ploutus to hack into automated teller machines (ATMs) across the U.S. and force them to dispense cash. The indicted members are alleged to be part of Tren de Aragua (TdA, Spanish for

Impact

Automated Teller Machines (ATMs), specifically those susceptible to Ploutus malware.

Exploitation Status

This vulnerability is confirmed to be actively exploited by attackers in real-world attacks. Organizations should prioritize patching or implementing workarounds immediately.

Timeline

Disclosed on [date]

Remediation

Financial institutions should enhance ATM security measures, including regular software updates and monitoring for unusual transaction patterns.

Additional Information

This threat intelligence is aggregated from trusted cybersecurity sources. For the most up-to-date information, technical details, and official vendor guidance, please refer to the original article linked below.

Related Topics: This incident relates to Exploit, Malware.

Read Original Article

Related Coverage

US imposes extended jail time on North Korean laptop farm facilitators

SCM feed for Latest

Kejia Wang and Zhenxing Wang, two residents of New Jersey, have been sentenced to nine years and nearly eight years in prison, respectively, for their roles in facilitating a North Korean laptop farm. This operation was part of a scheme that falsely represented IT workers, generating over $5 million for the North Korean regime. The laptop farm was used to support various illicit activities, highlighting the ongoing challenges posed by cyber operations linked to North Korea. The U.S. Department of Justice's actions aim to disrupt these types of operations and send a clear message against aiding sanctioned regimes. This incident serves as a reminder of the global reach of cybercrime and the importance of international cooperation in combating it.

Apr 17, 2026

Another PoC exploit released by 'BlueHammer' leaker after Microsoft dispute

SCM feed for Latest

A security researcher known as Chaotic Eclipse has released a proof-of-concept (PoC) exploit for a zero-day vulnerability in Microsoft Defender, identified as 'RedSun'. This follows the earlier disclosure of an exploit for another flaw in Defender, tracked as CVE-2026-33825, known as the BlueHammer flaw. The implications of these exploits are significant, as they expose users of Microsoft Defender to potential attacks that could compromise system security. Organizations using this antivirus solution should be particularly vigilant, as the release of these exploits could lead to increased attempts at exploitation by malicious actors. It's crucial for users to stay informed about updates from Microsoft regarding these vulnerabilities.

Apr 17, 2026

Ransomware attacks against automotive sector escalate

SCM feed for Latest

According to Infosecurity Magazine, ransomware attacks on automotive manufacturers have surged dramatically, with incidents more than doubling from 2024 to 2025. This alarming trend signals a growing vulnerability within the automotive sector, which has increasingly integrated digital technologies into its operations. As attackers target these manufacturers, the potential for significant disruptions in production and supply chains rises, posing risks not only to the companies involved but also to consumers and the broader economy. The rise in ransomware incidents indicates a pressing need for the automotive industry to enhance its cybersecurity measures and prepare for potential attacks. Companies must prioritize protecting their systems to safeguard against these evolving threats.

Apr 17, 2026

Nascent PowMix botnet covertly compromises Czech workforce

SCM feed for Latest

The PowMix botnet has been quietly targeting the workforce in the Czech Republic since December, using randomized communication techniques to evade detection. This stealthy operation involves the botnet compromising systems to potentially gain unauthorized access to sensitive information or resources. Researchers at The Hacker News have reported on the campaign, emphasizing the risk it poses to businesses and organizations in the region. As the botnet continues its activities, it raises concerns about the security of the Czech workforce and the need for enhanced protective measures against such covert attacks. Organizations are urged to remain vigilant and adopt robust security practices to defend against this emerging threat.

Apr 17, 2026

Underground guide reveals how threat actors vet stolen credit card markets

SCM feed for Latest

A newly released underground guide reveals insights into how cybercriminals assess and engage in the stolen credit card market. Rather than simply using stolen credit cards, the guide emphasizes a systematic approach where fraudsters carefully vet their suppliers. This shift indicates a more organized and methodical operation within the realm of credit card fraud. The implications are significant, as it suggests that attackers are becoming more sophisticated, which could lead to an increase in successful fraud attempts. As a result, consumers and financial institutions may face heightened risks as these organized networks operate more effectively.

Apr 17, 2026

DraftKings hacker sentenced to 30 months for credential stuffing scheme

SCM feed for Latest

In November 2022, a group of hackers executed a credential stuffing attack against DraftKings, using stolen usernames and passwords sourced from the dark web. This method allowed them to gain unauthorized access to numerous user accounts, compromising sensitive information for many customers. The incident culminated in a legal case where one of the attackers was sentenced to 30 months in prison. This case serves as a reminder of the dangers of reusing passwords across different platforms, as it can make users vulnerable to such attacks. Companies like DraftKings must ensure robust security measures are in place to protect user data from similar threats in the future.

Apr 17, 2026