U.S. DOJ Charges 54 in ATM Jackpotting Scheme Using Ploutus Malware

The Ploutus malware is deployed on ATMs by either replacing the hard drive with one preloaded with the malicious program or by connecting a removable thumb drive. The malware is equipped to issue unauthorized commands to the Cash Dispensing Module of ATMs to force currency withdrawals. It was first detected in Mexico in 2013 and exploits weaknesses in Windows XP-based ATMs. The malware can be activated via SMS messages sent to compromised ATMs and is designed to delete evidence of its presence to avoid detection. Threat actors conduct reconnaissance to assess external security measures and test alarm systems before deploying the malware.