U.S. to Deport Venezuelans Convicted of ATM Jackpotting Attacks Using Ploutus Malware

What happened

Federal prosecutors have secured convictions against Venezuelan nationals who conducted a coordinated ATM jackpotting campaign across the United States. The attackers used Ploutus malware, a specialized tool designed to force ATMs to dispense their entire cash reserves on command.

The operation is connected to Tren de Aragua, a notorious Venezuelan criminal organization that has expanded its operations from South America into the United States, diversifying into cybercrime alongside traditional criminal activities.

Following conviction, the individuals now face deportation as part of broader U.S. efforts to disrupt transnational cybercrime networks.

How ATM jackpotting works

ATM jackpotting is a physical-access attack that combines hardware manipulation with malware deployment.

Attack sequence

Step	Action
1. Physical access	Attacker gains access to ATM internals (lock picking, stolen keys, or exploiting poor physical security)
2. Connection	Attacker connects to internal ports (USB, serial, or CD-ROM drive)
3. Malware deployment	Ploutus or similar malware is installed, often by booting from external media
4. Cash-out	Attacker or accomplice ("money mule") triggers cash dispensing via keyboard codes or external commands
5. Extraction	Cash is collected, malware may be removed to avoid detection

Why Ploutus is effective

Ploutus was specifically designed for ATM environments:

• Targets Windows-based ATM platforms
• Interacts directly with the XFS (eXtensions for Financial Services) layer
• Can be controlled via keyboard commands or SMS (in some variants)
• Multiple versions targeting different ATM manufacturers

The Tren de Aragua connection

The involvement of Tren de Aragua highlights how traditional criminal organizations are adopting cyber techniques.

Organization profile

Attribute	Detail
Origin	Tocorón prison, Aragua state, Venezuela
Expansion	Now operates across South America, Central America, and the United States
Activities	Extortion, human trafficking, drug trafficking, financial crimes, and increasingly cybercrime
U.S. designation	Designated as a Transnational Criminal Organization (TCO)

This case demonstrates the convergence of:

• Traditional organized crime (physical operations, money mules)
• Cybercrime techniques (specialized malware)
• Cross-border operations (evading jurisdictional boundaries)

Defensive measures for financial institutions

Organizations operating ATMs should implement layered defenses addressing both physical and software attack vectors.

Physical security controls

Control	Implementation
Tamper-evident seals	Apply to all access panels; inspect regularly
Physical alarms	Alert on cabinet opening or vibration
CCTV coverage	Monitor all ATMs with adequate lighting and retention
Secure locations	Prioritize ATMs in staffed, well-lit areas
Key management	Strict control of maintenance keys; audit access logs

Software hardening

Control	Implementation
Application whitelisting	Only allow approved executables to run
Disable unused ports	USB, CD-ROM, and serial ports should be disabled in BIOS
Full-disk encryption	Protect against offline attacks
Secure boot	Prevent booting from external media
Regular patching	Keep ATM software and OS updated
Endpoint protection	Deploy ATM-specific security solutions

Detection and response

Warning signs of jackpotting

• Unusual ATM reboots or downtime
• Physical evidence of tampering (scratches, broken seals, residue)
• Anomalous cash dispensing patterns
• Error logs showing unauthorized software execution
• Reports of suspicious individuals near ATMs

Incident response steps

1. Isolate - Take the ATM offline immediately
2. Preserve - Do not reboot; preserve forensic evidence
3. Report - Contact law enforcement and your ATM vendor
4. Investigate - Review CCTV, access logs, and transaction records
5. Analyze - Conduct forensic analysis of the ATM system
6. Remediate - Address identified vulnerabilities before returning to service

Implications for the industry

This case has broader implications for financial sector security:

Immediate concerns

• Increased targeting: Successful prosecutions may temporarily deter, but jackpotting remains profitable
• Technique sharing: Malware and techniques spread through criminal networks
• Insider threats: Criminals may recruit ATM technicians or service personnel

Strategic considerations

Factor	Implication
Aging ATM fleet	Older ATMs running Windows XP/7 are more vulnerable
Remote locations	Unattended ATMs in low-traffic areas are higher risk
Third-party servicers	Supply chain security extends to maintenance contractors
Insurance coverage	Review policies for jackpotting-specific coverage

---

Conclusion

The conviction and deportation of Venezuelan nationals for Ploutus-based ATM jackpotting represents a law enforcement success, but the underlying threat persists. ATM jackpotting combines low technical barriers with potentially high payouts, making it attractive to both opportunistic criminals and organized groups.

Organizations operating ATMs should:

1. Audit physical security at all ATM locations
2. Implement software hardening including whitelisting and encryption
3. Train staff to recognize tampering indicators
4. Establish incident response procedures specific to jackpotting
5. Share threat intelligence with industry peers and law enforcement