DOJ Charges 54 Individuals in Multi-Million Dollar ATM Jackpotting Scheme
- Securityish
- Threats & Incidents
Quick Summary
The U.S. Department of Justice indicted 54 individuals involved in a multi-million dollar ATM jackpotting scheme using Ploutus malware. The group, linked to the Tren de Aragua gang, is accused of hacking ATMs to dispense cash illegally. This operation has resulted in approximately $40.73 million lost since 2021, highlighting significant cybersecurity risks associated with ATM vulnerabilities.
The Securityish Brief
The U.S. Department of Justice announced on December 9, 2025, the indictment of 54 individuals connected to a large-scale ATM jackpotting scheme. This conspiracy involved the deployment of Ploutus malware to compromise ATMs across the United States, forcing them to dispense cash. The indicted individuals are believed to be part of Tren de Aragua, a Venezuelan gang designated as a foreign terrorist organization by the U.S. State Department.
In total, 22 individuals were charged in one indictment for bank fraud, burglary, and money laundering, while another 32 were indicted in a related case for conspiracy to commit bank fraud and other charges. The operation has reportedly siphoned millions of dollars, with 1,529 jackpotting incidents recorded in the U.S. since 2021, leading to losses of about $40.73 million.
Understanding the Attack Methodology
The attackers conducted surveillance on ATMs to assess security measures before installing the Ploutus malware. They either replaced the ATM’s hard drive with a compromised one or used a thumb drive to load the malware. Once installed, Ploutus could issue unauthorized commands to the ATM’s cash dispensing module, allowing for cash withdrawals without authorization.
The malware was designed to erase traces of its presence, making it difficult for bank employees to detect the breach. This sophisticated approach not only facilitated theft but also funded various criminal activities associated with the Tren de Aragua gang.
Implications for Users and Organizations
This incident underscores the vulnerabilities present in ATM systems and the potential for significant financial losses. Everyday users should be aware of the risks associated with ATM usage, particularly in areas known for high rates of jackpotting. Organizations, especially financial institutions, must enhance their security measures to protect against such sophisticated attacks.
Monitoring ATM transactions and implementing robust security protocols can help mitigate the risks posed by malware like Ploutus. Additionally, awareness of the tactics used by cybercriminals can empower users to report suspicious activities promptly.
Key Takeaways
- Be cautious when using ATMs, especially in unfamiliar locations, and report any suspicious activity.
- Monitor your bank statements regularly for unauthorized transactions and report them immediately.
- Encourage your financial institution to implement advanced security measures for ATMs.
- Stay informed about the latest cybersecurity threats and how they might affect your financial transactions.
- Consider using bank apps or online banking for transactions when possible to minimize ATM usage.
Key Terms & Concepts
- Ploutus: In this article, Ploutus refers to malware used to hack ATMs and force them to dispense cash.
- Tren de Aragua: Tren de Aragua is a Venezuelan gang designated as a foreign terrorist organization by the U.S. State Department.
- ATM Jackpotting: ATM jackpotting is a method where criminals use malware to manipulate ATMs into dispensing cash illegally.
Read the original article here: https://thehackernews.com/2025/12/us-doj-charges-54-in-atm-jackpotting.html
Your 5-Minute Securityish Brief
A weekly digest of cybersecurity news, phishing alerts, privacy tips, and emerging threats, simplified so anyone can understand what matters and why.
Securityish
Securityish explains cybersecurity, scams, data breaches, and privacy risks in simple language so you know what’s happening and how to protect yourself.
© 2026 Securityish
