InfoSec Briefing - January 28, 2026

🚨 Critical Vulnerability Alert

We have critical security alerts. CVE-2026-24858 affecting Fortinet FortiOS and CVE-2026-23760 affecting SmarterMail email server have been added to the CISA Known Exploited Vulnerabilities catalog.

🎧 Audio Briefing

Playback Speed:

Download MP3

Good morning. This is your security briefing for Tuesday, January 27, 2026, covering 10 articles analyzed overnight. All attribution is by the article authors. All article analysis is automated.

We have critical security alerts. CVE-2026-24858 affecting Fortinet FortiOS and CVE-2026-23760 affecting SmarterMail email server have been added to the CISA Known Exploited Vulnerabilities catalog.

The OpenSSL Project released a security advisory addressing multiple vulnerabilities including CVE-2026-22795 and CVE-2026-22796 affecting specific versions of OpenSSL. These vulnerabilities pose security risks that could potentially be exploited to compromise systems, and defenders are urged to apply recommended upgrades immediately.

Google Threat Intelligence Group reports that Russian and Chinese government-backed threat actors, along with financially motivated groups, are actively exploiting CVE-2025-8088, a critical path traversal vulnerability in WinRAR patched in July 2025. Attackers leverage Alternate Data Streams to write malicious files to the Windows Startup folder, achieving persistent access on compromised systems across military, government, technology, and commercial sectors.

AmberWolf discovered a local privilege escalation vulnerability, CVE-2025-9142, in Check Point Harmony SASE agent's Perimeter81 component. The flaw allows attackers to exploit a directory traversal weakness in the service running with SYSTEM privileges by manipulating JWT tokens to write arbitrary files and achieve SYSTEM-level access.

Zscaler ThreatLabz identified the 'Gopher Strike' campaign targeting Indian government entities using custom Golang-based malware including GOGITTER downloader, GITSHELLPAD backdoor, and GOSHELL loader to deploy Cobalt Strike Beacons. The threat actors leverage private GitHub repositories for command and control communication, indicating a well-resourced actor conducting potential espionage against government targets.

Kaspersky Lab reports that the HoneyMyte threat actor has updated its CoolClient backdoor with enhanced data-stealing capabilities, including browser credential harvesting, document theft, and system reconnaissance tools. The malware uses DLL sideloading techniques with legitimate software from vendors like Sangfor, BitDefender, and VLC Media Player, targeting government sectors across Myanmar, Mongolia, Malaysia, Russia, Pakistan, and Thailand.

According to Reuters, a UK court awarded $4.1 million to Saudi dissident Ghanem Al-Masarir, ruling that Saudi Arabia was responsible for hacking his mobile phones using Pegasus spyware and orchestrating a physical assault against him in London. The case demonstrates state-sponsored cyber-espionage using nation-state exclusive spyware combined with physical intimidation tactics.

Code Blue 2024 conference videos have been published on YouTube, featuring technical presentation videos covering various security research topics, vulnerability analysis, and attack techniques from security researchers and practitioners.

Varonis Threat Labs identified 'Exfil Out&Look,' a novel attack technique that weaponizes Outlook add-ins to exfiltrate sensitive email data without detection. The method exploits malicious or overly permissive add-ins, particularly through Outlook Web Access, to intercept email events and extract content including subjects, bodies, recipients, and attachments from Microsoft 365 environments.

Blackpoint reports a cybersecurity campaign distributing Amatera Stealer malware through fake CAPTCHA pages targeting enterprise environments with Microsoft Application Virtualization components. The attack employs advanced evasion techniques including abuse of signed Microsoft scripts, in-memory execution, steganography, and multi-stage delivery mechanisms to bypass traditional security defenses.

The Department of Justice Office of Public Affairs announced charges against 87 defendants in an international ATM jackpotting scheme involving members of Tren de Aragua transnational criminal organization. Attackers deployed Ploutus malware variant by physically compromising ATMs, replacing hard drives or using thumb drives to install malware that forced cash dispensing and deleted evidence, resulting in millions of dollars stolen from U.S. financial institutions.

That concludes today's briefing.

📰 Articles Covered

OpenSSL Security Advisory (corrected - added CVE-2026-22795 and CVE-2026-22796) - The OpenSSL Project is controlled by the OpenSSL Foundation and the OpenSSL Corporation, which operate under the OpenSSL Mission and are responsible for any updates or changes to it. The OpenSSL Corporation is the official commercial arm of the OpenSSL Project, founded by its core contributors. Previously, technical direction was governed by the OpenSSL Technical Committee.

The OpenSSL project has released a security advisory detailing several vulnerabilities that have been discovered and fixed.

- **What Happened**: Multiple security vulnerabilities have been identified and addressed in various versions of OpenSSL. These include CVE-2026-22795 and CVE-2026-22796, among others mentioned in the advisory.
- **Who is Affected**: The advisory indicates that specific versions of OpenSSL are affected by these vulnerabilities. The exact scope of affected users depends on which versions are in use.
- **Security Implications**: These vulnerabilities pose security risks, the nature and severity of which depend on the specific CVE. They could potentially be exploited to compromise systems using vulnerable OpenSSL versions.
- **Technical Details**: The advisory provides technical details for each identified vulnerability, including specific CVE identifiers. For comprehensive technical information, users should refer to the full advisory.
- **What Defenders Should Know**: Defenders need to be aware of these vulnerabilities and **apply the recommended upgrades to OpenSSL immediately** to mitigate the associated risks. The advisory also points to OpenSSL's security policy for further guidance 【1】.
Diverse Threat Actors Exploiting Critical WinRAR Vulnerability CVE-2025-8088 - Google Threat Intelligence Group

A critical vulnerability in WinRAR, **CVE-2025-8088**, has been widely exploited by diverse threat actors to gain initial access and deliver various malicious payloads. This vulnerability was patched in July 2025.

**Who is Affected:**
The vulnerability affects users of WinRAR. Exploitation has been observed by both **Russian and Chinese government-backed groups** targeting military, government, and technology sectors, as well as **financially motivated actors** targeting commercial entities.

**Security Implications:**
The primary security implication is that the vulnerability allows threat actors to achieve **persistent access** to compromised systems. This is often accomplished by dropping malicious files into the Windows Startup folder, ensuring that the malware executes automatically whenever a user logs in.

**Technical Details:**
The exploit takes advantage of a **path traversal flaw** within WinRAR. Threat actors use **Alternate Data Streams (ADS)** to write files to arbitrary locations on the file system. A common technique involves writing malicious executables to the Windows Startup folder, facilitating automatic execution.

**What Defenders Should Know:**
Defenders must prioritize **keeping software updated and promptly installing security patches**. The article emphasizes that "n-day" vulnerabilities (those for which patches are available but not yet applied) continue to be a significant threat. Additionally, the article notes the existence of **exploit suppliers** in the underground economy and recommends utilizing tools like **Google Safe Browsing and Gmail** for protection 【1】.
Advisory - Check Point Harmony Local Privilege Escalation (CVE-2025-9142) - AmberWolf

A local privilege escalation vulnerability, identified as **CVE-2025-9142**, has been discovered in the Check Point Harmony SASE agent, specifically within the Perimeter81 software component `Perimeter81.Service.exe` 【1】. This vulnerability affects versions tested on `Harmony_SASE_11.5.0.2501` 【1】.

**What Happened:**
The vulnerability stems from a directory traversal flaw in the Perimeter81 Service. This service runs with `SYSTEM` privileges and creates a folder structure based on a tenant name found in a user's JSON Web Token (JWT) 【1】. The JWT is passed to the service via an Inter-Process Communication (IPC) call, triggered either directly through a named pipe or by using the `perimeter81://` URI handler 【1】. An attacker can exploit this by manipulating the JWT to include directory traversal sequences, allowing them to write arbitrary content to any location on disk using a symbolic link 【1】.

**Who is Affected:**
Users running the **Check Point Harmony SASE agent** on affected versions, specifically tested on `Harmony_SASE_11.5.0.2501`, are vulnerable 【1】.

**Security Implications:**
The primary security implication is **privilege escalation**. By exploiting the directory traversal and arbitrary file write capabilities, an attacker can achieve `SYSTEM` level privileges 【1】. This can be accomplished by:
- Forcing the service to write arbitrary content to any location on disk 【1】.
- Potentially causing the service to load malicious DLLs upon restart by writing a specially crafted DLL to a location where the service expects to find it 【1】.
- Overwriting critical system files or executing arbitrary code with `SYSTEM` privileges 【1】.

**Technical Details:**
The vulnerability lies in how the `Perimeter81.Service.exe` handles JWTs. The service component does not validate the JWT's signature before processing it 【1】. An attacker can craft a JWT with a malicious `tenantId` value, such as `../../../../../../../../sleep`, which is then used to construct file paths 【1】.

The exploitation process involves:
1. **Directory Traversal:** Using a crafted JWT with a traversal sequence in the `tenantId` to target a specific directory 【1】.
2. **Arbitrary File Deletion:** The `CleanCertFolder()` function, which uses the `WorkingDirectory` derived from the JWT, attempts to delete files in the specified directory. This can be leveraged with symbolic links to delete arbitrary files 【1】.
3. **Arbitrary File Write:** The `GenerateAndLoadCertificates()` function writes a private key and a client certificate (`client.crt`) to the `WorkingDirectory` as `SYSTEM`. By using symbolic links, an attacker can redirect these writes to any location, such as overwriting a DLL 【1】.
4. **Code Execution:** If an attacker can force the `Perimeter81` service to load a malicious DLL (e.g., `hostafxr.dll`) by writing it to the expected directory, they can achieve code execution with `SYSTEM` privileges when the service restarts 【1】.

The attack requires the Perimeter81 client to connect to an authorized domain. The availability of the `p81-falcon.com` domain for registration was a key factor in the exploit's feasibility 【1】.

**What Defenders Should Know:**
- **Update the Agent:** The most crucial mitigation is to **upgrade to the latest version of the Harmony SASE agent** 【1】. Check Point released version 12.2 with a fix for this vulnerability on November 18th, 2025 【1】.
- **Monitor Network Traffic:** Be aware of unusual network connections initiated by the Perimeter81 client, especially to newly registered or suspicious domains 【1】.
- **Understand the Attack Vector:** Defenders should be aware that the attack leverages the `perimeter81://` URI handler and IPC calls to the `Perimeter81.Service.exe`, which runs with `SYSTEM` privileges 【1】.
- **Patching:** While the exploit technique for arbitrary file deletion via symbolic links has been addressed by Microsoft patches for CVE-2024-38014 on unpatched operating systems, the specific implementation in the Perimeter81 service created a new avenue for exploitation 【1】.
GOGITTER, GITSHELLPAD, and GOSHELL Analysis | APT Attacks Target Indian Government Using GOGITTER, GITSHELLPAD, and GOSHELL - Zscaler ThreatLabz

A cybersecurity campaign, dubbed "Gopher Strike," has targeted Indian government entities, employing a sophisticated attack chain involving custom malware and private GitHub repositories for command and control (C2) communication. The campaign utilizes a Golang-based downloader named **GOGITTER**, a backdoor called **GITSHELLPAD**, and a shellcode loader known as **GOSHELL** to deploy a Cobalt Strike Beacon.

**What Happened:**
The attack begins with GOGITTER, which establishes persistence by creating a scheduled task to execute a VBScript file (`windows_api.vbs`). This script then communicates with C2 servers to fetch and execute further commands. GOGITTER also downloads a ZIP archive from a private GitHub repository, which contains GITSHELLPAD. GITSHELLPAD, the primary backdoor, uses GitHub repositories for its C2 communication, registering victims and polling for commands. It can execute various commands, including reconnaissance, file uploads/downloads, and running arbitrary commands. For further exploitation, GOSHELL is used to load a Cobalt Strike Beacon, enabling more advanced post-compromise activities.

**Who is Affected:**
The primary targets of this campaign are **Indian government entities** 【1】.

**Security Implications:**
The use of custom malware, private GitHub repositories for C2, and Cobalt Strike indicates a well-resourced and determined threat actor. The campaign's ability to evade detection through techniques like binary padding and masquerading poses a significant risk. The compromise of government entities can lead to the theft of sensitive information, disruption of services, and potential espionage.

**Technical Details:**
- **GOGITTER:** A 64-bit Golang downloader that drops and executes a VBScript (`windows_api.vbs`). It establishes persistence via a scheduled task named `MicrosoftEdge_ConfigurationUpdate_<random_number>` 【1】. It also downloads `adobe_update.zip` from a private GitHub repository, which contains GITSHELLPAD (`edgehost.exe`) 【1】.
- **GITSHELLPAD:** A 64-bit Golang backdoor that uses GitHub's REST API for C2. It creates directories on the threat actor's repository to store victim information and polls for commands in `command.txt`. It supports commands like `cd`, `run`, `upload`, and `download` 【1】. Logs and results are stored in `result.txt` and uploaded to GitHub.
- **GOSHELL:** A Golang-based loader designed to deploy Cobalt Strike Beacon. Its size is artificially inflated to approximately 1 GB with junk bytes to evade antivirus detection 【1】. It performs multiple decoding stages, including HEX-decoding and XOR operations, before executing the final Cobalt Strike payload 【1】. GOSHELL also employs environmental keying, only executing on specific hostnames 【1】.
- **Cobalt Strike Beacon:** The final payload, configured with HTTPS for C2, using XOR encryption and Base64 encoding for communication 【1】.

**What Defenders Should Know:**
- **Detection:** Zscaler's platform detects indicators related to GOGITTER 【1】. Defenders should monitor for the specific file hashes, network indicators (C2 URLs, domains), and the creation of scheduled tasks with dynamic names 【1】.
- **Persistence Mechanisms:** Be aware of the VBScript execution and scheduled tasks used for persistence 【1】.
- **C2 Infrastructure:** The use of private GitHub repositories as C2 channels is a key indicator 【1】. Monitor for unusual activity on GitHub, especially related to private repositories used for C2.
- **Malware Techniques:** Recognize the evasion techniques employed, such as binary padding, masquerading, and the use of ISO files to bypass Mark-of-the-Web controls 【1】.
- **Reconnaissance and Post-Compromise:** Understand the commands used for system and network reconnaissance, as well as file exfiltration to GitHub repositories 【1】.
- **Mitigation:** Implement robust endpoint detection and response (EDR) solutions, network traffic analysis, and security awareness training to mitigate phishing attempts 【1】. Regularly review and secure GitHub repositories used for development or collaboration.
HoneyMyte updates CoolClient backdoor, uses new data stealing tools - AO Kaspersky Lab

The cybersecurity article details the evolution of the **CoolClient backdoor**, a tool used by the **HoneyMyte threat actor**. This updated version incorporates new data-stealing capabilities, including browser credential harvesting and scripts for document theft and system reconnaissance.

**What Happened:**
The HoneyMyte threat actor has updated its CoolClient backdoor with enhanced functionalities. This includes new tools for stealing browser login credentials (targeting Chrome, Edge, and other Chromium-based browsers), as well as scripts for document theft and gathering system information. The CoolClient backdoor itself has evolved, utilizing DLL sideloading techniques with legitimate software from vendors like Sangfor, BitDefender, and VLC Media Player for execution. In some campaigns, a new rootkit has also been observed alongside CoolClient.

**Who is Affected:**
The campaigns deploying CoolClient and associated tools have been observed across **Myanmar, Mongolia, Malaysia, Russia, Pakistan, and Thailand**. The attacks appear to have a particular focus on the **government sector** in some of these regions. Victims are typically infected through a multi-stage process involving encrypted loader files and DLL sideloading.

**Security Implications:**
The implications of these attacks are significant, extending beyond traditional espionage. The CoolClient backdoor provides capabilities such as keylogging, clipboard monitoring, TCP tunneling, reverse proxy, and plugin execution. The addition of browser credential stealers, HTTP proxy credential sniffers, and document theft scripts indicates a move towards **active surveillance of user activity** and the harvesting of high-value data. This allows attackers to gain persistent access, monitor user behavior, and exfiltrate sensitive information.

**Technical Details:**
- **CoolClient Execution:** The malware often uses DLL sideloading, requiring a legitimate signed executable to load a malicious DLL. Recent variants abuse Sangfor software. The execution flow involves encrypted loader files (`loader.dat`, `main.dat`, `time.dat`) and shellcode.
- **Functionalities:** CoolClient collects system and user information, supports file upload/deletion, keylogging, TCP tunneling, reverse proxy, and plugin execution.
- **New Features:** The latest variant includes a **clipboard monitor** and an **HTTP proxy credential sniffer**. The clipboard monitor captures clipboard data and active window information, encrypting it with an XOR operation. The HTTP proxy credential sniffer intercepts network traffic to extract Base64-encoded proxy authentication credentials.
- **C2 Communication:** The primary C2 communication protocol is TCP, with UDP as an option. Commands are identified by magic values.
- **Plugins:** CoolClient supports various plugins for specific functionalities, including file management (`FileMgrS.dll`), remote shell (`RemoteShellS.dll`), and service management (`ServiceMgrS.dll`).
- **Browser Credential Stealers:** Variants target Chrome, Edge, and other Chromium-based browsers. They extract login credentials by accessing SQLite databases (`Login Data`) and decrypting passwords using keys from the `Local State` file, leveraging the Windows Data Protection API (DPAPI).
- **Document Theft:** Scripts are used for document theft and system information reconnaissance.

**What Defenders Should Know:**
Defenders need to be highly vigilant against the deployment of HoneyMyte's toolset, including the CoolClient backdoor and related malware families like PlugX, ToneShell, Qreverse, and LuminousMoth. Key areas of focus should include:
- **Monitoring for DLL Sideloading:** Implement detection mechanisms for unauthorized DLLs being loaded by legitimate executables.
- **Network Traffic Analysis:** Scrutinize network traffic for C2 communication patterns and potential exfiltration of credentials or sensitive data.
- **Endpoint Detection and Response (EDR):** Utilize EDR solutions to detect suspicious process behavior, file modifications, and the execution of unknown binaries.
- **Credential Security:** Educate users about the risks of saving credentials in browsers and enforce strong password policies.
- **Patch Management:** Ensure all software, especially those known to be abused for DLL sideloading (e.g., VLC, Sangfor products), are kept up-to-date.
- **Threat Intelligence:** Stay informed about HoneyMyte's evolving tactics, techniques, and procedures (TTPs) and the indicators of compromise (IOCs) associated with their campaigns.
Saudi dissident awarded $4.1 million by UK court for hacking, assault 'by Saudi Arabia' - Reuters

A UK court has awarded over 3 million pounds ($4.1 million) in damages to **Ghanem Al-Masarir**, a Saudi human rights activist and government critic who has been living in Britain since 2003. The court ruled that **Saudi Arabia was responsible for hacking Al-Masarir's mobile phones using Pegasus spyware and for orchestrating a physical assault against him in London** 【1】.

**Who is affected**:
- **Ghanem Al-Masarir**, a Saudi dissident and government critic, was the direct target of the hacking and assault 【1】.
- The ruling implies that **Saudi Arabia** is implicated in these actions 【1】.

**Security Implications**:
- The case highlights the use of **state-sponsored cyber-espionage** 【1】.
- The involvement of **Pegasus spyware**, which is exclusively sold to nation-states, suggests direct authorization or involvement by Saudi Arabia 【1】.
- The physical assault demonstrates the potential for **physical intimidation tactics** employed by states against critics 【1】.
- The rejection of Saudi Arabia's claim of state immunity indicates that **legal recourse may be available** against state-sponsored cyber-attacks 【1】.

**Technical Details**:
- The hacking was carried out using **Pegasus spyware** 【1】.

**What Defenders Should Know**:
- Defenders should be aware that **state actors may utilize sophisticated spyware** like Pegasus 【1】.
- **Physical intimidation tactics** can be employed alongside cyber-attacks 【1】.
- Despite attempts to claim state immunity, **legal avenues may exist** for victims of such attacks 【1】.
Code Blue 2024 conference videos - YouTube

I am sorry, but I cannot access external websites or specific YouTube playlists, including the one you provided. Therefore, I am unable to read the cybersecurity article and provide a detailed precis.
Exfil Out&Look for Logs: Weaponizing Outlook Add-ins for Zero-Trace Email Exfiltration - Varonis Threat Labs

A novel attack method, dubbed "Exfil Out&Look," has been identified that weaponizes Outlook add-ins to exfiltrate sensitive email data without detection 【1】.

**What Happened:**
Attackers are exploiting malicious or excessively permissive Outlook add-ins to steal email data. This technique is particularly effective when add-ins are used within Outlook Web Access (OWA), as OWA has fewer logging capabilities compared to the Outlook Desktop application. The method involves intercepting events, such as `OnMessageSend`, to extract email content, including subjects, bodies, recipients, and attachments 【1】.

**Who is Affected:**
Organizations using Microsoft 365 are vulnerable, especially those with add-ins installed or executed via OWA. The attack can be initiated by **insider threats**, **compromised user accounts**, or through **privileged administrator deployments** that push malicious add-ins across the entire organization 【1】.

**Security Implications:**
This attack creates a significant blind spot for security monitoring because it bypasses standard Microsoft 365 security controls and audit logging mechanisms. The exfiltration occurs silently, making it difficult to detect and investigate 【1】.

**Technical Details:**
The "Exfil Out&Look" technique leverages Outlook add-ins to hook into email events, such as `OnMessageSend`. This allows for the programmatic extraction of email data. The use of OWA is key to its stealth, as it lacks the robust logging found in the desktop client, thus leaving minimal forensic evidence 【1】.

**What Defenders Should Know:**
Defenders need to be aware of this technique due to its **simplicity, stealth, and the lack of visibility** it offers attackers. Key recommendations for defense include:
- **Enhancing platform-level audit logging** for add-in installations and their subsequent behaviors 【1】.
- Implementing a **risk classification system for add-ins** 【1】.
- **Restricting add-in installations** at the organizational level 【1】.
- **Reviewing administrator deployments** of add-ins 【1】.
- **Monitoring network traffic** for unusual patterns 【1】.
- **Increasing user awareness training** regarding the risks associated with add-ins 【1】.
Novel Fake CAPTCHA Chain Delivering Amatera Stealer - Blackpoint

A recent cybersecurity campaign has been identified that utilizes a **fake CAPTCHA lure** to distribute the **Amatera Stealer** malware. This sophisticated attack is designed for **high evasion**, employing a multi-stage approach to bypass standard security defenses.

**What Happened:**
The campaign begins with a fake CAPTCHA page, which, when interacted with, initiates a malicious chain of events. This chain leverages legitimate Windows features and third-party services to deliver the Amatera Stealer. Key techniques include the abuse of signed Microsoft scripts, in-memory execution to avoid disk-based detection, steganography to hide malicious code within seemingly harmless files, and the use of existing infrastructure to mask malicious activity.

**Who is Affected:**
The primary targets of this attack appear to be **enterprise environments** that utilize **Microsoft Application Virtualization (App-V)** components. The initial execution of the malware relies on specific Windows features, making environments with App-V particularly vulnerable.

**Security Implications:**
The advanced delivery mechanism of this campaign poses significant security risks. By evading traditional security measures, the malware can operate undetected for extended periods, increasing the potential for data breaches and system compromise. The ultimate goal is the deployment of Amatera Stealer, a potent information-stealing malware.

**Technical Details:**
The attack chain involves several technical elements:
- **LOLBIN Abuse:** The `SyncAppvPublishingServer.vbs` script, a legitimate Windows script, is abused as a "Living Off The Land Binary" (LOLBIN) for initial execution.
- **Dynamic PowerShell Resolution:** The malware dynamically resolves PowerShell cmdlets, making static detection more difficult.
- **Configuration Retrieval:** Malicious configuration data is fetched from files hosted on Google Calendar.
- **Steganography:** PNG images are used to conceal the malware payload through steganography.
- **In-Memory Execution:** The final payload is executed entirely in memory, leaving minimal traces on the disk.

**What Defenders Should Know:**
Security professionals should be aware of these advanced techniques and consider the following defensive measures:
- **Restrict Windows Run Dialog:** Limit the execution of arbitrary commands through the Windows Run dialog.
- **Remove Unnecessary App-V Components:** If not essential for operations, consider removing App-V components to reduce the attack surface.
- **User Education:** Educate users about the dangers of fake CAPTCHA lures and suspicious online prompts.
- **PowerShell Logging:** Enable comprehensive PowerShell logging to monitor for suspicious activities.
- **Process Monitoring:** Implement monitoring for unusual process lineages and behaviors.
- **Network Indicators:** Alert on specific network indicators, such as mismatched host headers and IP addresses, which can signal malicious activity.
Investigation into International “ATM Jackpotting” Scheme and Tren de Aragua results in Additional Indictment and 87 Total Charged Defendants - Office of Public Affairs

An international criminal operation, known as "ATM jackpotting," has been uncovered, involving the deployment of malware to steal millions of dollars from ATMs across the United States. This scheme is allegedly linked to the **Tren de Aragua (TdA)**, a violent transnational criminal organization that originated in Venezuela and has expanded its operations into the U.S. 【1】

**What Happened:**
The investigation revealed a conspiracy where a variant of malware called **Ploutus** was used to hack into ATMs and force them to dispense cash 【1】. This involved recruiting individuals to deploy the malware nationwide. These individuals would conduct reconnaissance on ATM security, then install the malware by replacing hard drives or using external devices like thumb drives. The malware was designed to issue unauthorized commands to the ATM's cash dispensing module and delete evidence to conceal the activity. The proceeds were then split among the conspirators 【1】. As of January 26, 2026, an additional indictment has brought the total number of charged defendants to 87, including many Venezuelan and Colombian nationals, some of whom are identified as illegal alien Tren de Aragua members 【1】.

**Who is Affected:**
The primary victims of this scheme are **financial institutions** in the United States, which have lost millions of dollars due to the fraudulent ATM withdrawals 【1】. Additionally, the Tren de Aragua organization, which is implicated in a wide range of horrific crimes including human trafficking (including child sex trafficking), kidnapping, murder, rape, and drug trafficking, is allegedly using the proceeds from these ATM jackpotting crimes to fund its terrorist activities 【1】.

**Security Implications:**
This case highlights significant security vulnerabilities in ATM systems, particularly the susceptibility to malware that can override normal operations and force cash dispensing 【1】. The involvement of a transnational criminal organization like TdA, which is also involved in violent crimes, indicates a sophisticated and dangerous criminal enterprise that poses a broad threat to public safety and financial security 【1】. The organization's ability to operate nationwide and exploit these vulnerabilities underscores the need for robust cybersecurity measures and inter-agency cooperation to combat such threats 【1】.

**Technical Details:**
The core of the technical operation involved the **Ploutus malware**, which was specifically designed to target ATMs 【1】. The deployment process included:
- **Recruitment:** Individuals were hired to carry out the malware deployment across the U.S. 【1】
- **Reconnaissance:** Groups would scout ATM locations, noting external security features 【1】
- **Malware Installation:** This was achieved by physically accessing the ATM, removing the hard drive to install the malware directly, replacing it with a pre-loaded drive, or using an external device like a thumb drive 【1】
- **Malware Functionality:** Ploutus issued unauthorized commands to the Cash Dispensing Module to force withdrawals and was programmed to delete evidence to evade detection 【1】

**What Defenders Should Know:**
Defenders, particularly financial institutions and law enforcement, should be aware of the following:
- **Sophistication of Attacks:** ATM jackpotting is a sophisticated attack vector that can lead to significant financial losses 【1】.
- **TdA's Involvement:** The Tren de Aragua organization is a dangerous entity that uses financial crimes like ATM jackpotting to fund its broader criminal and terrorist activities 【1】.
- **Nationwide Scope:** These operations are not isolated incidents but rather nationwide conspiracies, requiring coordinated law enforcement efforts 【1】.
- **Physical and Digital Security:** Both the physical security of ATMs and the digital security of their operating systems are critical. Defenders need to protect against both physical tampering and malware infections 【1】.
- **Inter-Agency Collaboration:** Combating organizations like TdA requires a "whole-of-government" approach, involving multiple law enforcement agencies and task forces working collaboratively 【1】.
- **Focus on Financial Pipelines:** Disrupting the financial streams of these organizations, such as through prosecuting ATM jackpotting schemes, is crucial to hindering their operations 【1】.