[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fx8LRdViXTW5OuDoTXmVelVvve40sGJyj3LNTVI11K1s":3},{"article":4,"iocs":53,"watch_terms":67,"solutions":68,"lesson":71},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":30,"category":31,"article_tags":35},"1298774c-6133-45b8-bddb-f50887469b9a","FBI Arrests ‘Most Wanted’ Developer of Ploutus ATM Malware","fbi-arrests-most-wanted-developer-of-ploutus-atm-malware-f07144","An alleged leader of Tren de Aragua’s ATM jackpotting activities, Canelon Aguirre was on the FBI’s top 10 most wanted list since March 2026. The post FBI Arrests ‘Most Wanted’ Developer of Ploutus ATM Malware appeared first on SecurityWeek.","Anibal Alexander Canelon Aguirre, a Venezuelan national accused of leading Tren de Aragua's ATM jackpotting operations and developing the Ploutus malware, has been arrested. He was on the FBI's top 10 most wanted list for cybercrimes. The malware allowed attackers to force ATMs to dispense cash without debiting accounts and included anti-analysis features.","FBI arrests alleged ATM malware developer and Tren de Aragua leader.","https:\u002F\u002Fwww.securityweek.com\u002Ffbi-arrests-most-wanted-developer-of-ploutus-atm-malware\u002F","https:\u002F\u002Fwww.securityweek.com\u002Fwp-content\u002Fuploads\u002F2024\u002F03\u002Fhacker-sentenced-prison.jpeg","2026-10-06T12:47:57+00:00","2026-10-06T14:00:28.85891+00:00",8,[17,20,23,25,27],{"name":18,"type":19},"Tren de Aragua","threat_actor",{"name":21,"type":22},"ATM","product",{"name":24,"type":19},"Prometheus",{"name":26,"type":19},"The Engineer",{"name":28,"type":29},"FBI","vendor","6cbdd207-aaa1-4176-9534-e156b125e917",{"id":30,"icon":32,"name":33,"slug":34},null,"Nation-state","nation-state",[36,38,43,48],{"category":37},{"id":30,"icon":32,"name":33,"slug":34},{"category":39},{"id":40,"icon":32,"name":41,"slug":42},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":44},{"id":45,"icon":32,"name":46,"slug":47},"c5eccf7c-abbc-4bd3-bbed-e6da5cba8e73","Incident Response","incident-response",{"category":49},{"id":50,"icon":32,"name":51,"slug":52},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[54,57,61,64],{"type":42,"value":55,"context":56},"Ploutus","ATM jackpotting malware developed by the arrested individual.",{"type":58,"value":59,"context":60},"mitre_attack","T1059.003","Command and Scripting Interpreter: Windows Command Shell - Implied by ATM malware functionality",{"type":58,"value":62,"context":63},"T1566.001","Phishing: Spearphishing Attachment - Potential initial access vector for malware deployment",{"type":58,"value":65,"context":66},"T1070.004","Indicator Removal: File Deletion - Ploutus malware could erase itself",[28,21],{"controls":69,"vendors":70},[],[],{"slug":72,"title":73,"body":74,"framework_refs":75,"framework_notes":88},"ploutus-atm-malware-developer-arrested-lessons-for-physical-logical-atm-security","Ploutus ATM Malware Developer Arrested — Lessons for Physical & Logical ATM Security","The Ploutus malware exploited weaknesses in ATM software and physical access controls, allowing attackers to force machines to dispense cash without any corresponding account debit — effectively stealing directly from financial institutions. The malware's inclusion of anti-analysis features demonstrates a sophisticated, long-running criminal operation designed to evade detection and forensic investigation. This case highlights that ATMs are specialized endpoints that require the same rigorous security hardening as any networked system, yet are often overlooked. The combination of weak physical access, outdated software, and insufficient monitoring created an environment where this fraud could persist for years across multiple countries. Financial institutions must treat ATM fleets as critical infrastructure with dedicated security programs.",[76,77,78,79,80,81,82,83,84,85,86,87],"CIS Control 2 — Inventory and Control of Software Assets","CIS Control 6 — Access Control Management","CIS Control 10 — Malware Defenses","CIS Control 13 — Network Monitoring and Defense","NIST SP 800-53 AC-3 — Access Enforcement","NIST SP 800-53 SI-7 — Software, Firmware, and Information Integrity","NIST SP 800-53 AU-6 — Audit Record Review, Analysis, and Reporting","NIST Cybersecurity Framework — Detect (DE.CM-1): Network Monitoring","PCI DSS Requirement 6 — Develop and Maintain Secure Systems","PCI DSS Requirement 9 — Restrict Physical Access to Cardholder Data","PCI DSS Requirement 10 — Log and Monitor All Access to System Components","ITIL — Incident Management & Problem Management Practices",{}]