57
55
55
35
30
57
30
30
30
35
57
30
Five plead guilty in latest federal ATM jackpotting case
Five Venezuelan nationals pleaded guilty to ATM jackpotting conspiracy tied to Ploutus malware, as FBI tallies $58 million in losses since 2021.
Five Venezuelan nationals pleaded guilty in Kansas federal court to conspiracy to commit bank larceny for attempted ATM jackpotting attacks in Wamego and Manhattan in December 2025; Luis Velasquez-Artigas was sentenced to nine months. The FBI says jackpotting has caused over $58 million in losses since 2021, with more than 1,900 incidents tracked since 2020 and over 700 in 2025. Separately, Juan Manuel Gouveia-Aguilera was sentenced to eight years and ordered to pay restitution for using Ploutus malware to steal more than $3.5 million from hundreds of ATMs. Prosecutors link the schemes to the Venezuelan gang Tren de Aragua and say at least 119 people have been charged.
35
30
30
55
35
30
30
30
35
30
57
Malspam Targeting Brazil Continues to Evolve
Brazilian malspam campaigns continue evolving, abusing Google URL shortener and Dropbox and using Squiblydoo plus DLL side-loading to deploy likely infostealing botnet malware.
A June 2017 Brazilian malspam campaign spoofed IPTU tax notification emails, using the recipient's address as the sender, and abused Google's URL shortener and Dropbox to deliver a zip containing a malicious Windows shortcut (.lnk) file. The LNK used the Squiblydoo technique (regsvr32.exe) to download and execute a scriptlet with elevated privileges, retrieving a signed G-Buster Browser Defense executable alongside a malicious fltLib.dll loaded via side-loading, likely an information-stealing botnet. Post-infection HTTP traffic exposed over 400 infected Windows hosts, mostly in Brazil, with 2,132 Banload-tagged samples observed in the first half of 2017.
20
30
30
42
42
42
30
55
57
30
60
57
60
30
55
42
30