Banks in Pakistan have been warned about Ploutus, a new ATM malware that can empty machines without using cards or customer accounts, raising urgent security concerns.
What Is Ploutus and How It Attacks ATMs
Banks across Pakistan have been put on high alert after a new wave of malware targeting Automated Teller Machines was flagged by the country’s payments infrastructure. The malware, known as Ploutus, has emerged globally as a major threat because it allows hackers to make ATMs dispense cash on command, without needing any bank cards or access to customer accounts.
According to an advisory issued by 1LINK and shared with all scheduled banks, Ploutus gives attackers direct control over affected machines. Instead of stealing customer data or breaking into core banking systems, the malware interacts with the ATM’s own software and hardware to send unauthorized cash-dispensing commands. This type of attack, often referred to as “jackpotting”, can drain large amounts of cash in minutes if it goes undetected.
Security experts warn that such malware is particularly dangerous because it targets the weakest links in the ATM environment: physical security and local system configuration. Once Ploutus is installed on a machine, many ordinary safeguards are bypassed, making it difficult for front-line staff to detect an attack until the damage has already been done.
How Criminals Break Into ATM Hardware and Software
The advisory explains that criminals typically begin by gaining physical access to the ATM cabinet. This may be done using widely available generic keys or by tampering with locks and panels when a machine is located in a poorly monitored area. Once inside, attackers can reach the ATM’s internal computer and storage devices.
Ploutus is then deployed by copying malicious software onto the hard drive or replacing the existing drive with one that already contains the malware. In many cases, the operating system used by ATMs, such as certain versions of Windows, is not hardened in the same way as core data centre systems, making it easier for attackers to run unauthorized code if physical access is achieved.
One of the worrying features of Ploutus is that it has been designed to work across different ATM brands and models. With only minor adjustments, the same malware framework can be adapted to multiple manufacturers, increasing the scale of the threat and reducing the effort required by organized criminal groups.
Warning Signs That an ATM May Be Compromised
The 1LINK advisory lists a number of Indicators of Compromise that banks and service providers should watch for on their networks and devices. These include the presence of suspicious .exe files, unauthorized remote access tools, abnormal autorun configurations and newly created custom services that are not part of the standard ATM software build.
Operational teams have also been advised to pay attention to unusual physical behaviour around ATMs. Examples include machine doors being opened outside scheduled maintenance windows, hard drives being removed or swapped without proper documentation, and unexplained reboots or shutdowns. Any such event should trigger immediate investigation and, where necessary, forensic analysis of the ATM’s logs and storage.
For devices running Windows, additional digital indicators may show up in system logs, task lists, registry entries and security alerts. The advisory urges banks to cross-check these signs against their endpoint protection systems and to maintain tight coordination between IT security teams and field engineers who handle onsite ATM maintenance.
Key Security Measures Banks Must Implement Now
To reduce the risk of Ploutus and similar attacks, the advisory sets out a series of recommended mitigation measures. On the physical side, banks are being urged to upgrade locks, install better sensors and surveillance cameras, and add barriers that make it harder for intruders to access the internal components of ATMs. Continuous monitoring of maintenance visits and door-open events is seen as a core part of this defence.
From a hardware and software perspective, institutions are advised to enable full disk encryption, firmware integrity checks, memory protection and device whitelisting so that only approved components and applications can run. External USB and other storage interfaces should be disabled by default, with any temporary enabling strictly logged and monitored. Network settings should enforce IP whitelisting and restrict traffic to known, trusted endpoints.
The advisory also stresses the importance of strong logging and auditing. Banks are encouraged to activate advanced audit policies to detect unauthorized file access or USB activity, maintain centralized log collection and regularly review ATM events for anomalies. Best practices such as changing default credentials, using trusted “gold images” when deploying machines and testing security controls in preproduction environments can further reduce exposure. Without swift and coordinated action, officials warn, Ploutus could enable large-scale ATM jackpotting, putting both banks and customers at serious financial risk.
