Treasury Blacklists Most-Wanted ATM Malware Developer and His Network
US Treasury sanctions ATM malware developer and network linked to Tren de Aragua.
The US Treasury Department has sanctioned Anibal Alexander Canelon Aguirre, known as 'Prometheus,' the alleged developer of the Ploutus ATM jackpotting malware, along with seven associates and two Mexico-based companies. Aguirre was recently added to the FBI's Ten Most Wanted Fugitives list for cybercrimes. The sanctions aim to disrupt the financial network supporting Tren de Aragua's ATM jackpotting schemes, which have caused over $40 million in losses across the US. The operation typically involves physically accessing ATMs, installing malware, and remotely triggering cash dispensing.
AI summary of the linked source. Not reviewed by an editor. How this works
Run FBI?
Get an email when a new story names FBI, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonThe Ploutus ATM jackpotting operation highlights how physical access to ATMs can be exploited as the entry point for devastating cyberattacks, bypassing many traditional network defenses. Attackers physically installed malware directly onto ATM hardware, then remotely triggered cash dispensing — a combined physical-cyber attack vector that many organizations fail to adequately defend against. With over $40 million in losses across the US, this case demonstrates that ATM security cannot rely solely on network controls; physical hardening and endpoint monitoring are equally critical. The existence of a well-funded criminal network around the malware developer also underscores how cybercrime ecosystems can sustain and scale attacks far beyond a single actor.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- malware — Ploutus