Ploutus
Ploutus is an ATM jackpotting malware family first detected in Mexico in 2013. It targets Windows-based ATMs and abuses the eXtensions for Financial Services (XFS) software layer to issue unauthorized commands to cash-dispensing hardware, allowing attackers to bypass normal bank authorization, card authentication, customer accounts, and transaction validation and force machines to dispense cash directly. Public reporting in the provided content describes Ploutus as affecting multiple ATM manufacturers and cash dispensers, with later variants requiring little code adjustment across vendors because they leverage the underlying Windows environment.
The malware is typically deployed after attackers gain physical access to an ATM. Reported installation methods include opening the ATM with widely available generic service keys, removing the hard drive to copy malware onto it, replacing the drive with one preloaded with Ploutus, or using removable media such as USB devices; some reporting also mentions use of external keyboards, USB hubs, and in earlier campaigns CD-ROM-based installation. Once installed, Ploutus can interact directly with ATM hardware through XFS and enable rapid cash-out operations within minutes, often without immediate detection. Historical reporting in the content notes early variants that could be triggered with an external keyboard and eight-digit activation key, SMS-enabled variants such as Ploutus.B, and Ploutus-D, which was reported to work on KAL’s Kalignite multivendor ATM platform and to have targeted Diebold ATMs. A later version targeting Latin American ATMs reportedly added mouse support.
The malware has been used globally in organized criminal ATM cash-out schemes and is repeatedly associated in the content with rising jackpotting activity in the United States and Latin America. The FBI warned in 2026 of increased malware-enabled ATM jackpotting, reporting roughly 1,900 incidents since 2020, including more than 700 incidents in 2025 and over $20 million in losses that year. The content also states ATM malware attacks in Latin America and the Caribbean rose significantly in 2025. Multiple reports in the content link Ploutus-based ATM theft conspiracies in the United States to actors associated with the Venezuelan gang Tren de Aragua. Targeting described in the content is focused on financial institutions, ATM operators, banks, credit unions, and ATM fleets across regions including Mexico, the United States, and broader Latin America.
High-confidence indicators mentioned in the content include suspicious executables such as Newage.exe, NCRApp.exe, WinMonitor.exe, WinMonitorCheck.exe, Color.exe, Levantaito.exe, Promo.exe, sdelete.exe, and Anydesk1.exe; associated files and scripts including C.dat, Restaurar.bat, Restauraropteva.bat, Logcontrol.txt, Logc.txt, and Borrar_beta.txt; suspicious directories such as C:\Users\SSAuto1\AppData\Local\P\ and C:<ATM_Manufacture>\exe\p; unauthorized remote tools such as AnyDesk or TeamViewer; deceptive persistence entries such as services named "ATM Service" or "Dispenser Service"; and relevant Windows event IDs tied to removable media, file access, process creation, service installation, log clearing, and audit changes, including 6416, 4663, 4688, 4697, 1102, and 4719. Reported MD5 hashes associated with observed activity are 2C2D16658D8DA6B389934273EF8F8E22, 5F177B84F3D92AB5711BE446125FDBE3, 61EECEB5F9186A0BC01DC82798CD6C5F, FDA82030AE92313E94B9339EA1FC107C, and C04A7CB926CCBF829D0A36A91EBF91BD.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Groups observed using it
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
A well-known strain of malware called Ploutus is among the types of malicious code being used in these hit.
Techniques & procedures
12 distinct techniques documented for this family, organized by ATT&CK tactic.
Initial Access
3 techniques
Initial Access
“Attackers frequently exploit generic service keys, outdated operating systems or unsecured USB ports before installing malware that bypasses bank authorisation controls,” he added.
Execution
2 techniques
Execution
Persistence
3 techniques
Persistence
“Attackers frequently exploit generic service keys, outdated operating systems or unsecured USB ports before installing malware that bypasses bank authorisation controls,” he added.
Privilege Escalation
3 techniques
Privilege Escalation
“Attackers frequently exploit generic service keys, outdated operating systems or unsecured USB ports before installing malware that bypasses bank authorisation controls,” he added.
Stealth
3 techniques
Stealth
“Services running with generic or deceptive names: ATM Service, Dispenser Service” and “Executable files not expected on the hard drive… NCRApp.exe… WinMonitor.exe…”
Lateral Movement
1 technique
Lateral Movement
Command and Control
2 techniques
Command and Control
Recent activity
35 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Listed as a notable commodity malware family that researchers used to analyze in depth.
A sophisticated ATM malware family used for jackpotting by sending unauthorized commands to ATM cash dispensing modules.
ATM jackpotting malware that manipulates cash dispensers to bypass authentication and transaction validation and directly command ATMs to dispense cash.
ATM malware used in jackpotting attacks to force cash machines to dispense money after attackers gain physical access to ATM hardware.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.