Alleged dev of Ploutus ATM malware appears in US court after arrest

Ploutus malware, developed by Anibal Alexander Canelon Aguirre, facilitated ATM jackpotting attacks that stole millions from banks and credit unions in the US from 2024 to 2025. The malware incorporated anti-analysis and self-deletion mechanisms to evade detection and forensic analysis. The criminal network laundering the stolen funds was connected to the Tren de Aragua Venezuelan gang, designated as a transnational criminal and foreign terrorist organization by US authorities. The DOJ has charged the developer and numerous accomplices with serious crimes including conspiracy to commit bank fraud, money laundering, and providing material support to terrorists. The attacks spanned 47 states and the District of Columbia, with at least 63 bank and 54 credit union ATMs compromised. The FBI has linked these crimes to a surge in ATM hacking losses exceeding $20 million in 2025.

The Ploutus malware enabled attackers to steal over $5.4 million in confirmed ATM jackpotting incidents and caused additional attempted thefts totaling more than $1.4 million. The attacks compromised ATMs across 47 US states and the District of Columbia, severely impacting financial institutions. The criminal organization involved is linked to a designated foreign terrorist group, increasing the severity of the threat. The malware's anti-forensic features complicated detection and response efforts, allowing prolonged fraudulent activity. The arrests and charges against the developer and accomplices aim to disrupt this extensive criminal operation.

The vendor advisory or patch information is not applicable as this is a criminal malware campaign rather than a software vulnerability. Mitigation focuses on law enforcement actions, arrests, and sanctions against the perpetrators. Financial institutions should continue to implement ATM security best practices and monitor for suspicious activity, but no specific patch or fix exists for the malware itself. The DOJ and FBI are actively prosecuting involved individuals and disrupting the criminal network.