ATM Jackpotting Attacks Surging Across US

Malware-wielding criminals “jackpotted” ATMs across the United States last year to walk away with $20 million in stolen cash.

See Also: How 72% of Enterprises Are Rewriting Cyber Resilience Playbooks

The FBI, tracking that collective haul, warned ATM operators that these malware-fueled attacks are on the rise. Of the 1,900 ATM jackpotting attacks in U.S. cataloged since 2020, 700 of them – or one-third – occurred last year.

Jackpotting or cash-out attacks involve tricking an ATM into disgorging cash, typically after infecting it with a strain of malware that gives an attacker full control of the device.

A well-known strain of malware called Ploutus is among the types of malicious code being used in these hit. The malware “attacks the ATM itself rather than customer accounts, enabling fast cash-out operations that can occur in minutes and are often difficult to detect until after the money is withdrawn,” according to a Thursday flash alert issued by the FBI.

All of these jackpotting attacks rely on physical access to an ATM. The FBI said the compromise typically begins with an attacker using a generic key to remove an ATM’s faceplate and then disconnecting the hard drive inside. Sometimes attackers connect the hard drive to a laptop to install malware, then replace the drive. Alternately, attackers can swap in their own hard drive, preloaded with malware, or use a malware-infected USB device. Finally, they reboot the ATM.

“The malware interacts directly with the ATM hardware, bypassing any communications or security of the original ATM software. The malware does not require connection to an actual bank customer account to dispense cash,” the FBI’s flash alert says.

Much of this activity appears to trace to criminal syndicates. Last December, the U.S. Department of Justice announced indictments charging 54 people for engaging in a conspiracy to use malware to steal millions of dollars from ATMs and then launder the ill-gotten gains. Prosecutors tied the activity to Tren De Aragua, originally a gang operating from Venezuela.

“These defendants employed methodical surveillance and burglary techniques to install malware into ATM machines, and then steal and launder money from the machines,” Acting Assistant Attorney General Matthew R. Galeotti of the Justice Department’s Criminal Division said in December 2025.

The DOJ now classifies Tren De Aragua as a “transnational criminal organization,” with the Department of State last July labeling it a “foreign terrorist organization,” with ties to drug trafficking, human smuggling, extortion, sexual exploitation and money laundering across the Western Hemisphere.

ATM Malware Evolves

Ploutus was first spotted in the wild in Mexico in 2013, when attackers used the CD-ROM drive in ATMs built by NCR to install the malware.

Initial versions of the malware required money mules to enter a unique, eight-digit key – provided by their jackpotting boss, and which would change every 24 hours – as well as attach an external keyboard and press the “F3” key to make the ATM dispense cash, said incident responders at Mandiant.

A subsequent iteration spotted not long after the first version, dubbed Ploutus.B, added the ability for the malware to work with a USB-enabled cell phone that would also be connected to the ATM at the time of initial infection. “What was interesting about this variant of Ploutus was that it allowed cybercriminals to simply send an SMS to the compromised ATM, then walk up and collect the dispensed cash, reported Symantec.

Mandiant in 2017 spotted a newer version, dubbed Ploutus-D, designed to infect a version of the Kalignite ATM platform software. While the samples it recovered from in-the-wild attacks only targeted machines built by Diebold, “minimal code change to Ploutus-D would greatly expand its ATM vendor targets since Kalignite platform runs on 40 different ATM vendors in 80 countries,” it said at the time.

By 2018, the U.S. Secret Service warned ATM manufacturers that Ploutus-D-driven attacks had crossed the southern border, with an updated version of the malware being used to target at that time two older Opteva series ATMs built by Diebold Nixdorf. In 2021, a new version emerged targeting ATMs in Latin America, with added mouse support, likely to help with touchscreen machines, reported CrowdStrike.

The latest versions of Ploutus offer widespread compatibility. “The malware can be used across ATMs of different manufacturers with very little adjustment to the code as the Windows operating system is exploited during the compromise,” the FBI said.

The bureau offered a number of recommendations to ATM operators to safeguard their devices against jackpotting attacks. Defenses include physical safeguards such as sensors designed to spot suspicious activity, and replacing the locks with non-standard options. At the hardware level, ATM operators can used encrypted hard drives to prevent malware from being installed, and firmware checks to verify authenticity whenever a device reboots, as well as monitor for known jackpotting indicators of compromise. If any IOCs are spotted a machine can be set to either automatically shut down or enter an “out of service” mode.

ATM Fraud Surges in Europe

While ATM jackpotting attacks have been surging in the United States, the view across the Atlantic is quite different.

The European Association for Secure Transactions reported last October that from the second half of 2024 to the first half of 2025, the number of confirmed ATM malware attacks across the region dropped from three to zero.

What accounts for the decline? EAST said adoption of ATM hardening guidance published by EU law enforcement intelligence agency Europol appears to have been a big factor.

Attackers in Europe have still continued to target ATMs. For the first six months of 2025, EAST cataloged 613 physical attacks, including explosive attacks and ripping out ATMs, which netted criminals $12.2 million. In the same timeframe, it counted 7,398 fraud attacks, resulting in a total theft of $1.2 million.

Much of this ATM fraud involved data relay attacks, including both terminal-to-terminal and card-to-terminal attacks, EAST said. These can involve intercepting legitimate card information and routing it to another terminal, where an attacker quickly uses it to withdraw cash or make a purchase.