[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fSaod91NHPhP3xG4NIirFDsjoo21hGKEifleaGHdwRws":3},{"article":4,"iocs":55,"watch_terms":58,"solutions":59,"lesson":62},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":32,"category":33,"article_tags":37},"097b93d0-9ac4-4e15-bccc-cf31287f20e1","Treasury Blacklists Most-Wanted ATM Malware Developer and His Network","treasury-blacklists-most-wanted-atm-malware-developer-and-his-network-5c3d1e","The US government continues its crackdown on Tren de Aragua over its ATM jackpotting scheme. The post Treasury Blacklists Most-Wanted ATM Malware Developer and His Network appeared first on SecurityWeek.","The US Treasury Department has sanctioned Anibal Alexander Canelon Aguirre, known as 'Prometheus,' the alleged developer of the Ploutus ATM jackpotting malware, along with seven associates and two Mexico-based companies. Aguirre was recently added to the FBI's Ten Most Wanted Fugitives list for cybercrimes. The sanctions aim to disrupt the financial network supporting Tren de Aragua's ATM jackpotting schemes, which have caused over $40 million in losses across the US. The operation typically involves physically accessing ATMs, installing malware, and remotely triggering cash dispensing.","US Treasury sanctions ATM malware developer and network linked to Tren de Aragua.","https:\u002F\u002Fwww.securityweek.com\u002Ftreasury-blacklists-most-wanted-atm-malware-developer-and-his-network\u002F","https:\u002F\u002Fwww.securityweek.com\u002Fwp-content\u002Fuploads\u002F2026\u002F01\u002FATM-hacking.jpg","2026-10-01T10:51:39+00:00","2026-10-01T12:00:19.249389+00:00",8,[17,20,22,25,28,30],{"name":18,"type":19},"Tren de Aragua","threat_actor",{"name":21,"type":19},"Prometheus",{"name":23,"type":24},"Ploutus","product",{"name":26,"type":27},"FBI","vendor",{"name":29,"type":27},"US Treasury Department",{"name":31,"type":27},"TRM Labs","6cbdd207-aaa1-4176-9534-e156b125e917",{"id":32,"icon":34,"name":35,"slug":36},null,"Nation-state","nation-state",[38,40,45,50],{"category":39},{"id":32,"icon":34,"name":35,"slug":36},{"category":41},{"id":42,"icon":34,"name":43,"slug":44},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":46},{"id":47,"icon":34,"name":48,"slug":49},"c5c77cdb-f7d7-4990-9436-c81dcbff1163","Policy","policy",{"category":51},{"id":52,"icon":34,"name":53,"slug":54},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[56],{"type":44,"value":23,"context":57},"Malware used in ATM jackpotting attacks.",[26,29,31],{"controls":60,"vendors":61},[],[],{"slug":63,"title":64,"body":65,"framework_refs":66,"framework_notes":77},"atm-jackpotting-malware-exposes-critical-physical-and-cyber-security-gaps","ATM Jackpotting Malware Exposes Critical Physical and Cyber Security Gaps","The Ploutus ATM jackpotting operation highlights how physical access to ATMs can be exploited as the entry point for devastating cyberattacks, bypassing many traditional network defenses. Attackers physically installed malware directly onto ATM hardware, then remotely triggered cash dispensing — a combined physical-cyber attack vector that many organizations fail to adequately defend against. With over $40 million in losses across the US, this case demonstrates that ATM security cannot rely solely on network controls; physical hardening and endpoint monitoring are equally critical. The existence of a well-funded criminal network around the malware developer also underscores how cybercrime ecosystems can sustain and scale attacks far beyond a single actor.",[67,68,69,70,71,72,73,74,75,76],"CIS Control 3 – Data Protection","CIS Control 6 – Access Control Management","CIS Control 13 – Network Monitoring and Defense","NIST SP 800-53 AC-3 – Access Enforcement","NIST SP 800-53 PE-3 – Physical Access Control","NIST SP 800-53 SI-3 – Malicious Code Protection","NIST SP 800-53 AU-6 – Audit Record Review","PCI DSS Requirement 9 – Restrict Physical Access to Cardholder Data","PCI DSS Requirement 10 – Log and Monitor All Access","ITIL – Incident Management and Problem Management",{}]