Critical

Alleged dev of Ploutus ATM malware appears in US court after arrest

BleepingComputer
Actively Exploited

Overview

The U.S. Department of Justice has arrested a man believed to be the creator of Ploutus malware, which has been implicated in ATM jackpotting schemes that have stolen millions across the country. This malware targets ATMs, allowing criminals to withdraw cash fraudulently. The arrest is significant as it could disrupt ongoing operations of cybercriminals using this method. The presence of such malware poses a threat to financial institutions and their customers, highlighting the need for enhanced security measures in ATM systems. Law enforcement agencies are working to understand the full extent of the malware's impact and to prevent further incidents.

Key Takeaways

  • Active Exploitation: This vulnerability is being actively exploited by attackers. Immediate action is recommended.
  • Affected Systems: ATMs, financial institutions
  • Action Required: Increased security measures for ATMs, monitoring for suspicious activities, updating ATM software and hardware to detect and prevent malware.
  • Timeline: Ongoing since [timeframe]

Original Article Summary

The U.S. Department of Justice has announced the arrest of the alleged developer of Ploutus malware, used to steal millions of dollars in ATM jackpotting attacks across the United States. [...]

Impact

ATMs, financial institutions

Exploitation Status

This vulnerability is confirmed to be actively exploited by attackers in real-world attacks. Organizations should prioritize patching or implementing workarounds immediately.

Timeline

Ongoing since [timeframe]

Remediation

Increased security measures for ATMs, monitoring for suspicious activities, updating ATM software and hardware to detect and prevent malware.

Additional Information

This threat intelligence is aggregated from trusted cybersecurity sources. For the most up-to-date information, technical details, and official vendor guidance, please refer to the original article linked below.

Related Topics: This incident relates to Malware.

Related Coverage

PEERSTITCH Malware Deployed via FortiOS Flaw Bypasses Checks on Tagged VPN Sessions

The Hacker News

A sophisticated threat actor is exploiting a vulnerability in Fortinet's FortiOS, which affects several of its products including FortiPAM, FortiProxy, and FortiSwitchManager. The flaw, identified as CVE-2025-61624, allows attackers to bypass security checks on tagged VPN sessions. This exploitation leads to the deployment of a new type of malware called PEERSTITCH, which operates in memory on ARM64 architecture. The CVSS score for this vulnerability is 5.4, indicating a moderate level of risk. Companies using these Fortinet products should be vigilant and assess their systems for potential attacks, as the exploitation is currently active in the wild.

Oct 16, 2026

AI Slop Isn't Just for Social Media; It's Ruining Cyberattacks, Too

darkreading

The article argues that artificial intelligence (AI) is making cyberattacks less sophisticated rather than more dangerous. It claims that serious cybercriminals are not utilizing AI tools extensively, suggesting that these technologies are not living up to the hype in the cybersecurity realm. Instead, the author indicates that traditional methods of attack are still prevalent and effective. This perspective raises questions about the true impact of AI on cybersecurity and whether it is genuinely enhancing threats or merely complicating the landscape. Companies and security teams should remain vigilant, as the article hints at a disconnect between AI capabilities and practical, malicious use.

Oct 15, 2026

Hackers exploit Collabora RCE flaw to backdoor Nextcloud servers

BleepingComputer

Hackers are taking advantage of a serious command execution vulnerability, identified as CVE-2026-110447, in the Collabora Online - Built-in CODE Server app, which is used within Nextcloud. This flaw allows attackers to run arbitrary commands on affected systems, potentially leading to unauthorized access and backdoors in Nextcloud servers. Organizations using this application are at risk, as the exploitation of this vulnerability is already occurring in the wild. Users need to take immediate action to secure their systems and ensure they are not compromised. The issue highlights the ongoing challenges in securing collaborative tools that are increasingly used for remote work and data sharing.

Oct 15, 2026

Critical PwnEscape Linux Kernel Vulnerability Lets Guest VMs Read Host Memory

The Hacker News

A serious vulnerability in the Linux kernel, identified as CVE-2026-99999 and dubbed PwnEscape, has been revealed, allowing virtual machines (VMs) to access the memory of the host system. This flaw is located within the networking code of the Linux kernel, meaning it affects multiple cloud environments, not just one particular setup. A researcher demonstrated this vulnerability on Vercel's cloud sandboxes, and the company confirmed the issue. This breach poses significant risks, as it could enable attackers to extract sensitive data from the host machine, potentially compromising the integrity and confidentiality of the systems involved. Companies using Linux-based virtual machines should be vigilant and take appropriate measures to safeguard their environments.

Oct 15, 2026

The next election influence campaign will target your AI chatbot

CyberScoop

Researchers have discovered that someone is actively creating hyperlocal content about political races, which is intended to influence AI chatbots. This content is being used to train these chatbots to favor specific candidates on various issues. The implications are significant, as this practice could undermine the integrity of information provided by AI systems, potentially skewing public perception and decision-making during elections. Users of AI chatbots, especially those seeking unbiased information, may find themselves receiving manipulated responses that reflect these hidden agendas. This situation raises concerns about the ethical use of AI and the importance of transparency in how these systems are trained.

Oct 15, 2026

Hackers hijack D-Link, Ubiquiti devices to resell your stolen bandwidth

BleepingComputer

A recent campaign has targeted D-Link and Ubiquiti devices across 34 countries, allowing hackers to hijack these devices to create a commercial residential proxy network. This practice, known as proxyjacking, enables attackers to monetize stolen bandwidth from unsuspecting users. The impact is significant as it not only affects individual users' internet speeds and data privacy but also raises concerns about the security of these widely used devices. Users whose devices have been compromised may find their internet connections slower and could potentially face additional security risks if their devices are manipulated for illicit purposes. The situation underscores the need for users to secure their devices and remain vigilant against unauthorized access.

Oct 15, 2026