#malware — insecure by design

high1 source

Federal Courts Sentence ATM Jackpotting Crews Deploying Ploutus Malware Across the US

Five Venezuelan nationals have pleaded guilty in Kansas federal court to conspiracy to commit bank larceny after attempting to compromise ATMs using malware. The group drove from Indiana to Kansas in December 2025 to execute jackpotting attacks against machines in Wamego and Manhattan, but their attempts failed and triggered local police alarms. Surveillance cameras captured the perpetrators, leading to their arrests shortly thereafter, with one defendant receiving a nine-month prison sentence while four others await sentencing. Federal prosecutors noted that the crew intentionally targeted specific ATM models perceived to have vulnerable designs susceptible to physical and software-based exploitation. According to federal authorities, jackpotting operations have escalated dramatically, accounting for over $58 million in losses across more than 1,900 incidents tracked since 2020. The FBI noted that 2025 alone saw over 700 jackpotting incidents that resulted in more than $20 million in stolen funds. These guilty pleas follow the recent sentencing of another operative in Omaha, Nebraska, who received eight years in prison for his role in a multi-state ring utilizing the `Ploutus` malware family. In these attacks, criminals typically compromise physical enclosures to connect a rogue laptop directly to the internal hard drive or swap the drive entirely with an infected, pre-configured image. Over 119 individuals have faced charges connected to these operations, which have hit financial hardware in 47 states and multiple foreign jurisdictions. Prosecutors have linked the revenue generated from these attacks directly to transnational criminal groups, specifically Tren de Aragua.

critical1 source

Fire Ant Operatives Pivot to Cisco Routers and Linux Management Infrastructure for Covert Traffic Sniffing

Incident responders at Sygnia identified a sophisticated campaign attributed to the Chinese cyber espionage threat group known as Fire Ant, showing a notable tactical shift away from VMware hypervisors toward core network infrastructure. Investigators uncovered an active Generic Routing Encapsulation (`GRE`) tunnel interface on a Cisco IOS XR router that had no corresponding configuration record or commit history. The attackers established persistent access via custom malware executing as a disguised system service designed to run strictly during alternating hours to evade detection. To keep operators blind, the implant intercepted and suppressed syslog messages related to the tunnel, facilitated interactive unlogged shells, and maintained outbound Telnet communication to external attacker servers. Beyond basic command execution, the group leveraged administrative access on multiple compromised routers to run raw packet captures, funneling the resulting PCAP files out to external FTP servers. These covert captures exposed internal topologies, raw authentication flows, administrative connections, and sensitive traffic traveling across trusted pathways. The stealthy `GRE` tunnel bridged compromised network gear directly to a legacy Linux staging host inside the victim's environment. From this intermediary beachhead, the adversaries performed targeted reconnaissance across adjacent high-value environments, including critical infrastructure assets, probing services like SSH, SMB/RPC, RDP, and HTTP interfaces. On the Linux side, analysts discovered a brand new backdoor dubbed `BridgeAgent` that masqueraded as a genuine Zabbix monitoring agent, maintaining persistence as a root-level `systemd` service. `BridgeAgent` handled TLS-encrypted reverse shells and functioned as a modular drop point for subsequent attack stages, all while operators meticulously tampered with system logs and modified filesystem timestamps to hinder forensics. Sygnia noted extensive operational overlap between Fire Ant and the Chinese espionage nexus previously tracked by Google as UNC3886, despite minor divergences in specific filenames and implementation logic.