Federal Courts Sentence ATM Jackpotting Crews Deploying Ploutus Malware Across the US
Five Venezuelan nationals have pleaded guilty in Kansas federal court to conspiracy to commit bank larceny after attempting to compromise ATMs using malware. The group drove from Indiana to Kansas in December 2025 to execute jackpotting attacks against machines in Wamego and Manhattan, but their attempts failed and triggered local police alarms. Surveillance cameras captured the perpetrators, leading to their arrests shortly thereafter, with one defendant receiving a nine-month prison sentence while four others await sentencing. Federal prosecutors noted that the crew intentionally targeted specific ATM models perceived to have vulnerable designs susceptible to physical and software-based exploitation. According to federal authorities, jackpotting operations have escalated dramatically, accounting for over $58 million in losses across more than 1,900 incidents tracked since 2020. The FBI noted that 2025 alone saw over 700 jackpotting incidents that resulted in more than $20 million in stolen funds. These guilty pleas follow the recent sentencing of another operative in Omaha, Nebraska, who received eight years in prison for his role in a multi-state ring utilizing the `Ploutus` malware family. In these attacks, criminals typically compromise physical enclosures to connect a rogue laptop directly to the internal hard drive or swap the drive entirely with an infected, pre-configured image. Over 119 individuals have faced charges connected to these operations, which have hit financial hardware in 47 states and multiple foreign jurisdictions. Prosecutors have linked the revenue generated from these attacks directly to transnational criminal groups, specifically Tren de Aragua.
Commentary
ATM jackpotting has evolved from an obscure hardware trick into a heavily industrialized physical-cyber attack pipeline. The persistence of the `Ploutus` malware family—first spotted over a decade ago—highlights a glaring weakness in standard embedded financial endpoints: inadequate physical security controls coupled with weak bus-level encryption between the core operating system and the dispenser unit (often communicating via standard XFS middleware APIs). When attackers can simply pick an enclosure lock, disconnect a SATA cable, or connect directly to internal diagnostic USB ports, high-level operating system defenses become largely irrelevant. Financial institutions and third-party ATM operators must harden the physical perimeter of standalone machines by deploying chassis intrusion sensors tied directly to cryptographic tamper triggers. On the software side, enforcing full-disk encryption (BitLocker with strict TPM measurement), disabling boot from external media, and requiring encrypted communication channels between the host PC and the internal Cash Dispensing Unit (CDU) are essential baselines to render pre-loaded drives and rogue laptop attachments completely ineffective.
The Quote to Remember
“This particular group’s strategy was to specifically target ATMs they thought were by design more vulnerable to malware”
“In many cases, criminals either link a laptop to the ATM’s hard drive or replace it with an infected drive pre-loaded with the Ploutus malware.”