US DOJ CHARGES 54 IN ATM JACKPOTTING SCHEME USING PLOUTUS MALWARE

Summary from the TLDR InfoSec newsletter

The DOJ indicted 54 individuals linked to Venezuelan gang Tren de Aragua for deploying Ploutus malware in a multi-million dollar ATM jackpotting operation involving 1,529 incidents since 2021, resulting in $40.73 million stolen to fund terrorist activities. Attackers conducted physical reconnaissance, opened ATM hoods to test alarm responses, then installed Ploutus by replacing hard drives or connecting USB drives to issue unauthorized commands to Cash Dispensing Modules while deleting forensic evidence. The malware targets Windows-based ATMs (particularly legacy XP systems and Diebold models) and can be activated via a physical keyboard with activation codes. Financial institutions should implement physical tamper detection on ATM enclosures, upgrade legacy Windows XP systems, monitor Cash Dispensing Module command patterns for anomalies, implement hard drive integrity checks and USB port access controls, and deploy enhanced physical security measures, including alarm response verification protocols.