Ploutus-I

The Ploutus ATM Malware family has been around since 2013, and its creators are continuing to use it by releasing regular updates, which introduce new features. The most recently discovered iteration of the malware is called Ploutus-I, and it seems to target Automated Teller Machines (ATMs) situated in Latin America. Often, ATM malware is compatible with a particular ATM model, which has exploitable vulnerabilities – in the case of the Ploutus-I, it goes after Itautec-made ATM devices.

Just like other ATM malware, the Ploutus-I also needs to be installed manually by a criminal who has physical access to the device. Often, this is done by accessing the USB port on the back of the device, but it seems that the crooks need to use a more aggressive technique for Itautec-made devices – they extract the hard drive before planting the malware on it. Ploutus-I's files are dropped in a whitelisted folder called 'Itautec.'

The authors of the Ploutus-I have the ability to limit the number of times their malware can be used per day – this way, they control the amount of money their mules can make from infected ATMs. It is important to add that users of ATM devices are not endangered by Ploutus-I – this malware does not try to hijack credit card data. It is designed to take over the ATM, and then command it to dispense a specific amount of money from its cash cassettes.

Ploutus-I, just like other ATM malware, is cleverly tailored to target specific vulnerabilities in particular ATM models. Regular ATM maintenance and security checks can help prevent attacks from threats like the Ploutus-I Malware.