Alleged dev of Ploutus ATM malware appears in US court after arrest
Alleged Ploutus ATM malware developer arrested in US court.
Anibal Alexander Canelon Aguirre, the alleged developer of the Ploutus ATM jackpotting malware, has been arrested and appeared in US court. The malware was used in attacks between February 2024 and December 2025, stealing over $5.4 million from ATMs and laundering funds for the Tren de Aragua (TdA) gang. Aguirre was also listed on the FBI's 'Top 10 Most Wanted Fugitives' list.
AI summary of the linked source. Not reviewed by an editor. How this works
The lesson from this incident
Full lessonThe Ploutus ATM malware case highlights the severe risk posed by sophisticated financial malware that exploits weak access controls and insufficient monitoring on ATM infrastructure. Attackers were able to install and execute jackpotting malware across multiple ATMs, siphoning over $5.4 million before detection — indicating dangerously long dwell times and inadequate anomaly detection. The connection to organized crime (Tren de Aragua) underscores that ATM attacks are no longer opportunistic but are coordinated, well-funded operations. This case matters because financial institutions that treat ATMs as low-priority endpoints leave themselves exposed to both physical and logical attack vectors that directly impact consumer trust and regulatory standing.
What helps against this
How we list vendors- Device management (MDM and UEM)
Every company laptop and phone is known, encrypted, locked down and up to date.
- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
- Immutable backup and recovery
Ransomware cannot delete or encrypt your way back.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- malware — Ploutus
- malware — Prometheus