Category: Uncategorized

  • U.S. DOJ Charges 54 in ATM Jackpotting Scheme Using Ploutus Malware

    U.S. DOJ Charges 54 in ATM Jackpotting Scheme Using Ploutus Malware


    Dec 20, 2025Ravie LakshmananCybercrime / ATM Security

    The U.S. Department of Justice (DoJ) this week announced the indictment of 54 individuals in connection with a multi-million dollar ATM jackpotting scheme.

    The large-scale conspiracy involved deploying malware named Ploutus to hack into automated teller machines (ATMs) across the U.S. and force them to dispense cash. The indicted members are alleged to be part of Tren de Aragua (TdA, Spanish for “the train of Aragua”), a Venezuelan gang designated a foreign terrorist organization by the U.S. State Department.

    In July 2025, the U.S. government announced sanctions against the group’s head, Hector Rusthenford Guerrero Flores (aka Niño Guerrero), and five other key members for their involvement in the “illicit drug trade, human smuggling and trafficking, extortion, sexual exploitation of women and children, and money laundering, among other criminal activities.”

    Cybersecurity

    The Justice Department said an indictment returned on December 9, 2025, has charged a group of 22 people for supposedly committing bank fraud, burglary, and money laundering. Prosecutors also alleged that TdA has leveraged jackpotting schemes to siphon millions of dollars in the U.S. and transfer the ill-gotten proceeds among its members and associates.

    Another 32 individuals have been charged in a second, related indictment returned on October 21, 2025, accusing them of “one count of conspiracy to commit bank fraud, one count of conspiracy to commit bank burglary and computer fraud, 18 counts of bank fraud, 18 counts of bank burglary, and 18 counts of damage to computers.”

    If convicted, the defendants could face a maximum penalty of anywhere between 20 and 335 years in prison.

    “These defendants employed methodical surveillance and burglary techniques to install malware into ATM machines, and then steal and launder money from the machines, in part to fund terrorism and the other far-reaching criminal activities of TDA, a designated Foreign Terrorist Organization,” said Acting Assistant Attorney General Matthew R. Galeotti of the Justice Department’s Criminal Division.

    The jackpotting operation is said to have relied on the TdA recruiting an unspecified number of individuals to deploy the malware across the nation. These individuals would then conduct initial reconnaissance to assess external security measures installed at various ATMs and then attempt to open the ATM’s hood to check if they triggered any alarm or a law enforcement response.

    Following this step, the threat actors would install Ploutus by either replacing the hard drive with one that came preloaded with the malicious program or by connecting a removable thumb drive. The malware is equipped to issue unauthorized commands associated with the Cash Dispensing Module of the ATM in order to force currency withdrawals.

    “The Ploutus malware was also designed to delete evidence of malware in an effort to conceal, create a false impression, mislead, or otherwise deceive employees of the banks and credit unions from learning about the deployment of the malware on the ATM,” the DoJ said. “Members of the conspiracy would then split the proceeds in predetermined portions.”

    Cybersecurity

    Ploutus was first detected in Mexico in 2013. In a 2014 report, Symantec detailed how a weakness in Windows XP-based ATMs could be exploited to allow cybercriminals to withdraw cash simply by sending an SMS to compromised ATMs. A subsequent analysis from FireEye (now part of Google Mandiant) in 2017 detailed its ability to control Diebold ATMs and run on various Windows versions.

    “Once deployed to an ATM, Ploutus-D makes it possible for a money mule to obtain thousands of dollars in minutes,” it explained at the time. “A money mule must have a master key to open the top portion of the ATM (or be able to pick it), a physical keyboard to connect to the machine, and an activation code (provided by the boss in charge of the operation) in order to dispense money from the ATM.”

    According to the agency, a total of 1,529 jackpotting incidents have been recorded in the U.S. since 2021, with about $40.73 million lost to the international criminal network as of August 2025.

    “Many millions of dollars were drained from ATM machines across the United States as a result of this conspiracy, and that money is alleged to have gone to Tren de Aragua leaders to fund their terrorist activities and purposes,” U.S. Attorney Lesley Woods said.



    Source link

  • India express train kills seven elephants crossing tracks

    India express train kills seven elephants crossing tracks


    Seven wild Asian elephants, including calves, were killed when a high-speed train collided with a herd crossing the tracks in north-eastern India, local officials say.

    They say another calf was injured in the incident early on Saturday in Hojai district, Assam state.

    The Northeast Frontier Railway says the train driver spotted dozens of elephants and used the emergency brakes – but some animals were still hit.

    Five carriages derailed after the collision, but no injuries were reported among passengers and staff on the Delhi-bound express. Train cancellations and diversions were reported in the area during the day.

    The killed elephants were later examined by veterinarians and buried.

    Assam has one of the biggest elephant populations in India, with nearly 6,000 animals recorded in the state.

    Local railway tracks are often crossed by elephant herds – but Saturday’s incident happened at a location that was not a designated elephant corridor, the Northeast Frontier Railway says.



    Source link

  • Togo’s Faure Gnassingbé walks a diplomatic tightrope between Russia and France

    Togo’s Faure Gnassingbé walks a diplomatic tightrope between Russia and France


    Paul MellyWest Africa analyst

    AFP Faure Gnassingbé applauded by other leaders in Washington in December.AFP

    Faure Gnassingbé is cultivating a range of sometimes opposing alliances

    While some West African nations are choosing to cement old ties with France and others cultivate a new relationship with Russia, one country is trying to have the best of both worlds.

    As the 7 December attempted military coup in Benin collapsed, the rebels’ leader, Lt Col Pascal Tigri, made his discreet escape, apparently over the border into neighbouring Togo. From this temporary refuge, it seems he was then able to travel on to a more secure offer of asylum elsewhere – probably in the Burkina Faso capital Ouagadougou, or Niamey in Niger.

    The opacity surrounding Togo’s rumoured role in this affair is typical of a country that, under the leadership of Faure Gnassingbé, knows how to extract the maximum diplomatic leverage by defying convention and cultivating relations with a variety of often competing international partners.

    The Lomé regime is far too shrewd to be caught out openly supporting a challenge to Benin’s President Patrice Talon – with whom its relations are guarded at best – or officially confirming the Béninois belief that it secured coup-leader Tigri’s passage to safety. Both governments are members of the beleaguered Economic Community of West African States (Ecowas).

    Yet Gnassingbé makes no secret of cultivating affable and supportive relations with Burkina Faso and the fellow Sahelian military governments in Niger and Mali – all three of whom walked out of Ecowas last January.

    Nor is he afraid of reminding France, Togo’s traditional main international partner, that he has other options.

    On 30 October President Emmanuel Macron welcomed Gnassingbé to the Élysée Palace for talks aimed at strengthening bilateral relations.

    But less than three weeks later, the Togolese leader was in Moscow for a notably warm encounter with Russian President Vladimir Putin. They formally approved a defence partnership allowing Russian vessels to use Lomé port, one of the best-equipped deepwater harbours on the western coast of Africa and a key supply gateway for the landlocked Sahelian states that, following the military coups of 2020 to 2023, have become key Kremlin protégés.

    While Gnassingbé’s trip to Paris was fairly low-key, his Moscow excursion was high-profile and wide-ranging.

    The bilateral military accord provides for intelligence and joint military exercises (although Lomé has no plans to provide a base for the Africa Corps, the Kremlin-controlled successor to the now disbanded Wagner mercenary outfit). All this was supplemented with plans for economic cooperation and an announcement of the reopening of their respective embassies, both closed back in the 1990s.

    Anadolu via Getty Images Two women in matching wax fabrics.Anadolu via Getty Images

    Most people in Togo have only ever known life under the Gnassingbé family

    Inevitably all this has unsettled France, for whom Togo was once regarded as among the most devoted of allies.

    When Lt Col Tigri launched his coup attempt in Benin, Macron was quick to show other Ecowas governments that it was France that could rapidly provide emergency specialist military support for their intervention to protect constitutional order.

    The Togolese insist that their move to strengthen ties with Russia is not a conscious move to break ties with the West. Instead, Lomé presents the move as a natural diversification of relationships.

    And there is some coherence to this argument.

    Three years ago Togo and Gabon opted to complement their longstanding participation in the grouping of French-speaking countries, the International Francophonie Organisation (IOF), with membership of the Commonwealth too. Meanwhile, last year English-speaking Ghana, a Commonwealth stalwart, joined the Francophonie.

    Indeed, these days many West African governments become exasperated with the outside world’s tendency to view such connections as a choice between a new Cold War alignment or taking sides in a parochial anglophone-francophone competition between former colonial powers.

    They say they want to be friends with a wide range of international partners and see no reason why such relationships should be exclusive.

    Togo’s premier, perhaps more than any other leader in West Africa, has sought to extend this diversified approach to his regional dealings.

    Lomé is a major freight and travel hub whose port can accommodate the largest ocean-going container ships, with feeder vessels distributing transhipped cargo to a range of other smaller or shallower ports that could not do so. From Lomé’s airport, local flights fan out across western and central Africa. The city is also home to banks and other regional financial entities.

    These connections have helped to diversify the economic foundations of a country whose rural areas remain relatively poor.

    AFP via Getty Images King Charles III shakes hands during an audience with the President of the Togolese Republic Faure Gnassingbé at Buckingham Palace.AFP via Getty Images

    French-speaking Togo recently joined the Commonwealth – a club of mainly former British colonies

    Togo needs to remain at the heart of the Ecowas regional grouping and, in fact, sits astride the key Lagos-Abidjan transport corridor, a major development priority for the bloc.

    But Gnassingbé has concluded that he also needs to maintain strong relations with the breakaway military-run regimes, now grouped in their own Alliance of Sahelian States (AES) – which Togo’s Foreign Minister, Prof Robert Dussey has even speculated about joining.

    But this is about more than economic or diplomatic diversification. It also connects to Gnassingbé’s domestic political strategy.

    A constitutional change announced in 2024 and implemented this year transformed the presidency – which carries a term limit – into a purely ceremonial role and shifted all executive authority into the post of prime minister, now dubbed “president of the council” in a borrowing of Spanish and Italian terminology. This latter post is subject to no term limit.

    That allowed Gnassingbé to hand over the presidency to a low-profile regime stalwart and take on the new strong premier role, with little prospect of an end limit on his rule, given the longstanding dominance of his political party, Union for the Republic (UNIR) in successive parliamentary elections.

    This was hugely controversial. But protest was rapidly snuffed out.

    AFP via Getty Images People in a market in the Togolese capital.AFP via Getty Images

    Togo lies at the heart of some of West Africa’s major trade routes

    Individuals even peripherally connected to demonstrations are in custody. High-profile critics such as the rapper Aamron (real name Narcisse Essiwé Tchalla) or the former defence minister Marguerite Gnakadè – who was married to Gnassingbé’s late elder brother – have been threatened with prosecution. Journalists say they have been intimidated.

    Members of the government have accused protesters of violence. They have warned of “fake news” on social media, argued that human rights arguments are being used to destabilise the situation, accusing elements of civil society of fabricating allegations against the security forces.

    In the words of one minister: “Effectively it’s terrorism when you encourage people to commit unprovoked violence.”

    In September, the European Parliament approved a resolution demanding the unconditional release of political prisoners, including the Irish-Togolese dual national Abdoul Aziz Goma, who has been in detention since 2018.

    Togo’s government responded by calling in the EU ambassador to tell him that the country’s justice system operated with total independence.

    Through his diverse international strategy, Gnassingbé is seeking to warn off Western critics, signalling that he has choices and options and does not need to cede to Europe, or anyone else.

    However, Togo has a history of sudden eruptions of protest or unrest.

    And despite his bullish tone, the new “president of the council” may quietly have concluded that it would be wise to afford a gesture of magnanimity, to salve the resentments that still bubble under the surface.

    In a state of the nation address earlier this month, he said he would instruct the justice minister to look at possible prisoner releases.

    This hint of retreat from the earlier crackdown shows that even Gnassingbé’s nimble international networking cannot defuse the underlying political discontent at home.

    AFP via Getty Images Russia's President Vladimir Putin and Togo's President of the Council of Ministers Faure Gnassingbé shake hands as they meet at the Kremlin in Moscow.AFP via Getty Images

    Russia now has access to the landlocked Sahel juntas it backs, through Togo’s deepwater port

    You may also be interested in:

    Getty Images/BBC A woman looking at her mobile phone and the graphic BBC News AfricaGetty Images/BBC



    Source link