Tren de Aragua Gang Charged for ATM Jackpotting Using Ploutus Malware
- Securityish
- Threats & Incidents
Quick Summary
The Tren de Aragua (TdA) gang faces charges for deploying Ploutus malware on ATMs across the US, allegedly stealing millions. Two indictments in Nebraska charge 54 members for ATM jackpotting attacks, which have resulted in over $40 million stolen since 2020. This incident highlights significant cybersecurity risks related to physical device tampering and malware deployment.
The Securityish Brief
The Tren de Aragua (TdA) gang, described by US officials as a “ruthless terrorist organization,” has been indicted for allegedly deploying a variant of Ploutus malware on ATMs across the United States. The gang’s activities have resulted in significant financial losses, with ATM jackpotting attacks accounting for over $40 million stolen since 2020. The indictments, returned in Nebraska, charge 54 alleged members of TdA in connection with these attacks.
The gang’s method involves inspecting ATMs for external security features before tampering with them. They either replace the ATM’s hard drive with one preloaded with Ploutus or install the malware directly using external thumb drives. This sophisticated approach allows them to issue commands that force ATMs to dispense cash.
In addition to the ATM-related charges, the gang members face various other serious allegations, including assault and money laundering. The US government has intensified its crackdown on TdA, with multiple indictments across various states since January, reflecting a broader effort to dismantle transnational criminal organizations.
Understanding the Risks of ATM Jackpotting
This incident underscores the vulnerabilities present in ATM systems, particularly those that can be compromised through physical access. Users and organizations should be aware that such attacks can lead to significant financial losses, not only for banks but also for customers who may face increased fees or reduced access to cash.
For everyday users, the presence of malware like Ploutus highlights the importance of monitoring bank statements and reporting any suspicious activity immediately. Organizations managing ATMs should enhance their physical security measures and regularly update their software to protect against such threats.
As law enforcement continues to pursue members of the TdA gang, it is crucial for both individuals and organizations to remain vigilant about their security practices. This includes understanding how malware can be deployed and recognizing the signs of potential tampering with ATMs.
Key Takeaways
- Regularly monitor bank statements for unauthorized transactions.
- Report any suspicious activity at ATMs immediately to your bank.
- Organizations should enhance physical security measures for ATMs.
- Keep ATM software updated to protect against malware threats.
- Educate staff about recognizing signs of tampering with ATMs.
Key Terms & Concepts
- Ploutus malware: In this article, Ploutus malware refers to a type of software that targets ATMs, allowing attackers to dispense cash illegally.
- ATM jackpotting: ATM jackpotting is a method where criminals use malware to force ATMs to dispense cash.
- Tren de Aragua (TdA): Tren de Aragua is a Venezuelan gang accused of various criminal activities, including ATM jackpotting and other violent crimes.
Read the original article here: https://go.theregister.com/feed/www.theregister.com/2025/12/19/tren_de_aragua_atm/
Your 5-Minute Securityish Brief
A weekly digest of cybersecurity news, phishing alerts, privacy tips, and emerging threats, simplified so anyone can understand what matters and why.
Securityish
Securityish explains cybersecurity, scams, data breaches, and privacy risks in simple language so you know what’s happening and how to protect yourself.
© 2026 Securityish
