Threat Intel
ATM Malware Architect Appears in Nebraska Court After Arrest
Anibal Aguirre, the alleged mastermind behind the Ploutus ATM‑jackpotting malware, pleaded not guilty in a Nebraska court after his arrest in Venezuela. The case underscores the scale of ATM theft—over 1,500 attacks and $40.7 million in losses—and highlights the need for tighter ATM security. Defenders should review firmware integrity, physical access controls, and monitoring for malware signatures.
What Happened
Anibal Alexander Canelon Aguirre, a 50‑year‑old Venezuelan national known as “Prometheus” and “The Engineer,” was arrested in Venezuela and returned to the United States. He appeared in a Nebraska district court on Friday and pleaded not guilty to charges including conspiracy to commit bank fraud, bank burglary, computer‑related fraud, money laundering, and providing material support to terrorists.
Impact
Aguirre is alleged to have engineered the Ploutus malware that enabled criminals to physically open ATMs, connect a device, and remotely drain the machine of all cash. The FBI has documented more than 1,500 jackpotting incidents that have cost banks $40.7 million. The scheme is linked to the transnational group Tren de Aragua.
What Defenders Should Do
- Verify firmware authenticity and integrity on all ATMs.
- Enforce strict physical security—restrict access to ATM service panels and monitor for tampering.
- Deploy endpoint protection that detects known Ploutus signatures and anomalous network traffic.
- Implement real‑time monitoring of ATM cash levels and transaction logs for sudden depletion.
- Coordinate with banks and law enforcement to share indicators of compromise.
Legal Context
Aguirre faces up to 70 years in prison if convicted.
Related articles
US Treasury Sanctions Tren de Aragua Members Over ATM Jackpotting Attacks
The U.S. Treasury Department has sanctioned eight members of the Venezuelan Tren de Aragua gang for orchestrating ATM jackpotting attacks that stole millions from U.S. banks. The sanctions target individuals who deployed malware such as Ploutus to force ATMs to dispense cash and erase evidence. Defenders should update ATM firmware, monitor for known malware, and enforce network segmentation.
Read briefing
FBI Arrests Ransomware Negotiation Firm Founder Linked to ShinyHunters
The FBI arrested Edward Dubrovsky, co-founder of Cypfer and CyberSteward, in Pennsylvania on charges related to cyber extortion and conspiracy. This arrest connects to the ongoing investigation into the ShinyHunters hacking group, which previously compromised FBI data. Defenders should review policies regarding engagement with ransomware negotiation firms.
Read briefing
FTC sues Digital Forensics Corp for $60M sextortion scam
FTC has filed a complaint against Digital Forensics Corp and affiliates for scamming sextortion victims, claiming $60M in fraudulent payments. The company advertised services that never delivered and fabricated evidence. A federal court has temporarily halted their operations.
Read briefing
TONResolver RAT Targets Japanese Hospitality Sector via Booking.com Phishing
A targeted phishing campaign observed in May 2026 deployed the TONResolver RAT against hotels and accommodation providers in Japan. Threat actors utilized Booking.com-themed lures to deliver the malware, which uniquely abuses the TON blockchain for command-and-control operations.
Read briefing