[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fzBNFlfghUn_-O_lnFgckhYZpqsFbtT9QfyUOtnRbfO0":3},{"article":4,"iocs":45,"watch_terms":52,"solutions":53,"lesson":135},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":22,"category":23,"article_tags":27},"ac7526a0-2775-4d6c-bf4a-02d643a0c4ec","Alleged dev of Ploutus ATM malware appears in US court after arrest","alleged-dev-of-ploutus-atm-malware-appears-in-us-court-after-arrest-7f005e","The U.S. Department of Justice has announced the arrest of the alleged developer of Ploutus malware, used to steal millions of dollars in ATM jackpotting attacks across the United States. [...]","Anibal Alexander Canelon Aguirre, the alleged developer of the Ploutus ATM jackpotting malware, has been arrested and appeared in US court. The malware was used in attacks between February 2024 and December 2025, stealing over $5.4 million from ATMs and laundering funds for the Tren de Aragua (TdA) gang. Aguirre was also listed on the FBI's 'Top 10 Most Wanted Fugitives' list.","Alleged Ploutus ATM malware developer arrested in US court.","https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fsuspected-dev-of-ploutus-atm-malware-appears-in-us-court-after-arrest\u002F","https:\u002F\u002Fwww.bleepstatic.com\u002Fcontent\u002Fhl-images\u002F2026\u002F04\u002F29\u002FLaw_enforcement_arrest.jpg","2026-10-05T13:01:45+00:00","2026-10-05T14:00:20.172804+00:00",9,[17,20],{"name":18,"type":19},"Tren de Aragua (TdA)","threat_actor",{"name":21,"type":19},"Anibal Alexander Canelon Aguirre","89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5",{"id":22,"icon":24,"name":25,"slug":26},null,"Malware","malware",[28,33,38,40],{"category":29},{"id":30,"icon":24,"name":31,"slug":32},"2e06f76c-d5b9-4f54-9eef-4d3447b10730","Breaches","breaches",{"category":34},{"id":35,"icon":24,"name":36,"slug":37},"6cbdd207-aaa1-4176-9534-e156b125e917","Nation-state","nation-state",{"category":39},{"id":22,"icon":24,"name":25,"slug":26},{"category":41},{"id":42,"icon":24,"name":43,"slug":44},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[46,49],{"type":26,"value":47,"context":48},"Ploutus","ATM jackpotting malware used in attacks",{"type":26,"value":50,"context":51},"Prometheus","Alias for Ploutus malware developer",[],{"controls":54,"vendors":134},[55,76,105],{"slug":56,"name":57,"problem":58,"products":59},"endpoint-management","Device management (MDM and UEM)","Every company laptop and phone is known, encrypted, locked down and up to date.",[60,68],{"vendor_slug":61,"vendor_name":62,"vendor_logo":63,"product_slug":64,"product_name":65,"url":66,"description":67},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"vendor_slug":69,"vendor_name":70,"vendor_logo":71,"product_slug":72,"product_name":73,"url":74,"description":75},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"slug":77,"name":78,"problem":79,"products":80},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[81,89,97],{"vendor_slug":82,"vendor_name":83,"vendor_logo":84,"product_slug":85,"product_name":86,"url":87,"description":88},"eset","ESET","\u002Fvendor-logos\u002Feset.png","eset-protect","ESET PROTECT","https:\u002F\u002Fwww.eset.com\u002Fint\u002Fbusiness\u002Fsolutions\u002Fendpoint-protection\u002F","Endpoint protection platform with detection and response add-ons.",{"vendor_slug":90,"vendor_name":91,"vendor_logo":92,"product_slug":93,"product_name":94,"url":95,"description":96},"sophos","Sophos","\u002Fvendor-logos\u002Fsophos.png","sophos-endpoint","Sophos Endpoint","https:\u002F\u002Fwww.sophos.com\u002Fen-us\u002Fproducts\u002Fendpoint-security","Endpoint protection with Intercept X anti-ransomware technology and EDR.",{"vendor_slug":98,"vendor_name":99,"vendor_logo":100,"product_slug":101,"product_name":102,"url":103,"description":104},"sentinelone","SentinelOne","\u002Fvendor-logos\u002Fsentinelone.png","singularity-endpoint","Singularity Endpoint","https:\u002F\u002Fwww.sentinelone.com\u002Fplatform\u002Fendpoint-security\u002F","Endpoint protection and detection with automated response and rollback.",{"slug":106,"name":107,"problem":108,"products":109},"immutable-backup","Immutable backup and recovery","Ransomware cannot delete or encrypt your way back.",[110,118,126],{"vendor_slug":111,"vendor_name":112,"vendor_logo":113,"product_slug":114,"product_name":115,"url":116,"description":117},"cohesity","Cohesity","\u002Fvendor-logos\u002Fcohesity.png","dataprotect","Cohesity DataProtect","https:\u002F\u002Fwww.cohesity.com\u002Fplatform\u002Fdataprotect\u002F","Backup and recovery with immutable snapshots, on premises or as a service.",{"vendor_slug":119,"vendor_name":120,"vendor_logo":121,"product_slug":122,"product_name":123,"url":124,"description":125},"commvault","Commvault","\u002Fvendor-logos\u002Fcommvault.png","commvault-cloud","Commvault Cloud","https:\u002F\u002Fwww.commvault.com\u002Fplatform","Backup and recovery platform with immutable storage and recovery testing.",{"vendor_slug":127,"vendor_name":128,"vendor_logo":129,"product_slug":130,"product_name":131,"url":132,"description":133},"rubrik","Rubrik","\u002Fvendor-logos\u002Frubrik.png","zero-trust-data-protection","Rubrik Zero Trust Data Protection","https:\u002F\u002Fwww.rubrik.com\u002Fproducts\u002Fdata-protection","Air-gapped, immutable backup for on-premises, cloud and SaaS data, with threat detection in backups and orchestrated recovery.",[],{"slug":136,"title":137,"body":138,"framework_refs":139,"framework_notes":150},"ploutus-atm-jackpotting-malware-exposes-critical-physical-and-logical-atm-security-gaps","Ploutus ATM Jackpotting Malware Exposes Critical Physical and Logical ATM Security Gaps","The Ploutus ATM malware case highlights the severe risk posed by sophisticated financial malware that exploits weak access controls and insufficient monitoring on ATM infrastructure. Attackers were able to install and execute jackpotting malware across multiple ATMs, siphoning over $5.4 million before detection — indicating dangerously long dwell times and inadequate anomaly detection. The connection to organized crime (Tren de Aragua) underscores that ATM attacks are no longer opportunistic but are coordinated, well-funded operations. This case matters because financial institutions that treat ATMs as low-priority endpoints leave themselves exposed to both physical and logical attack vectors that directly impact consumer trust and regulatory standing.",[140,141,142,143,144,145,146,147,148,149],"CIS Control 2 – Inventory and Control of Software Assets","CIS Control 4 – Secure Configuration of Enterprise Assets","CIS Control 13 – Network Monitoring and Defense","NIST SP 800-53 AC-3 – Access Enforcement","NIST SP 800-53 SI-3 – Malicious Code Protection","NIST SP 800-53 AU-6 – Audit Record Review and Reporting","NIST Cybersecurity Framework DE.CM-1 – Network Monitoring","PCI DSS Requirement 6.3 – Security Vulnerabilities Addressed","PCI DSS Requirement 9.4 – Physical Access to ATMs","FFIEC IT Examination Handbook – ATM Security Controls",{}]