FBI: $20 Million Losses Caused by 700 ATM Jackpotting Attacks in 2025
Source SecurityWeek
Description
The FBI has confirmed that the Ploutus malware, which has been around for over a decade, is still being used in the wild. The post FBI: $20 Million Losses Caused by 700 ATM Jackpotting Attacks in 2025 appeared first on SecurityWeek .
Impact
The primary impact of Ploutus ATM jackpotting attacks is financial loss, as attackers forcibly dispense cash from compromised ATMs. Beyond direct monetary theft, these attacks can erode customer trust in financial institutions and damage the reputation of ATM operators. The operational disruption caused by compromised ATMs can lead to service outages and increased maintenance costs. Additionally, the persistence of such attacks may encourage further criminal activity targeting ATM infrastructure. Organizations worldwide, especially banks and ATM service providers, face increased risk of fraud losses and regulatory scrutiny. The threat also highlights systemic vulnerabilities in ATM security, particularly in regions where legacy systems remain in use. While the attacks require physical access, the scale of incidents reported indicates that attackers have been able to exploit these opportunities repeatedly, suggesting gaps in physical and network security controls.
Defensive guidance
To mitigate Ploutus ATM jackpotting attacks, organizations should implement a multi-layered security approach: 1) Enhance physical security by installing tamper-evident seals, surveillance cameras, and restricting access to ATM internals. 2) Upgrade ATM software and firmware to the latest versions that include security patches and hardened configurations. 3) Employ endpoint protection solutions specifically designed for ATM environments to detect and block unauthorized code execution. 4) Segment ATM networks from other corporate networks to limit malware propagation and unauthorized access. 5) Conduct regular security audits and penetration testing focused on ATM infrastructure. 6) Train staff and ATM service personnel to recognize signs of tampering and suspicious behavior. 7) Implement strict access controls and logging for all maintenance activities. 8) Collaborate with law enforcement and industry groups to share threat intelligence and respond rapidly to incidents. These targeted measures go beyond generic advice by addressing both the physical and cyber aspects of ATM security.
Summary
Ploutus malware is a specialized ATM jackpotting malware family that has been active for over a decade. It enables attackers to gain unauthorized control over ATM machines, forcing them to dispense cash on command. The malware typically requires physical access to the ATM to install, often involving the use of hardware devices or USB drives to load the malicious code. Once deployed, Ploutus can bypass ATM security controls and manipulate the cash dispenser mechanism. The FBI's recent confirmation highlights that despite its age, Ploutus remains a prevalent threat, with 700 attacks in 2025 resulting in $20 million in losses. This persistence is largely due to many ATMs running outdated operating systems and lacking modern security controls. The attacks are sophisticated, requiring attackers to have both technical expertise and physical access, but the financial impact is significant. The malware's continued use underscores the challenges in securing legacy ATM infrastructure and the need for comprehensive security strategies that include both cyber and physical protections.