Suspected Ploutus ATM Malware Developer Appears in U.S. Court

[Dave1]

https://www.documentcloud.org/documents/28721126-canelon-aguirre-and-accomplices-indictment/

So the US DOJ has arrested the alleged developer of Ploutus malware.

The Ploutus ATM malware family, first detected in 2013 by Symantec as Backdoor.Ploutus, allows attackers to withdraw cash from an ATM machine on command. The malware is installed by accessing the ATM’s CD-ROM drive and inserting a new boot disk that delivers the Ploutus variant. After connecting an external keyboard to the ATM machine, threat actors must press ‘F8’ to display the hidden trojan window. Once visible, numerous commands can be executed such as pressing ‘F1’ to generate ATM ID, ‘F2’ to activate ATM ID, and ‘F3’ to dispense cash.

https://www.cyber.nj.gov/threat-landscape/malware/atm-malware/ploutus

Anibal Alexander Canelon Aguirre, known as "Prometheus" and "The Engineer", deployed this malware with the help of his accomplishes also name in the court document. As they emptied  bank and credit union automated teller machines (ATMs) in jackpotting attacks between February 2024 and December 2025.

And they have stolen more than $5.4 million stolen in at least 63 ATM jackpottings targeting banks and another 54 against credit unions, plus an additional $1,429,738 in attempted attacks. The money stolen was then laundered to accounts controlled by the Tren de Aragua (TdA) Venezuelan gang in various countries.

So it's a blend of jackpotting plus involvement of trans national group or criminal gangs.

Maximum sentences for this group ranges from  20 to 335 years in prison each.

[Dr.Bitcoin_Strange]

Maximum sentences for this group ranges from  20 to 335 years in prison each.

They have stolen a whole lot of money from 63 ATMs according to the report, so I do not think that 20 years sentence is even enough for such crime, life sentence is perhaps a good punishment for them because they have been operating for a long time and have rubbed people off their had earned money. If authorities can also recover some of the money they have stolen by ceasing their properties and selling it off, that would be nice too.

[NotFuzzyWarm]

What is not reported is how they accessed the internals of the ATM's. You cannot just walk up to one and slip in a disk or plug in a keyboard...

Did they steal them? Have an inside man with access to the internals to plant the malware and plug in a Bluetooth keyboard dongle so they could later just drive up and do the thefts?

[suzanne5223]

What is not reported is how they accessed the internals of the ATM's. You cannot just walk up to one and slip in a disk or plug in a keyboard...

Did they steal them? Have an inside man with access to the internals to plant the malware and plug in a Bluetooth keyboard dongle so they could later just drive up and do the thefts?

There's an indepth information about how the attacker did the operation, the Bitcoin ATM that seems to be affected, and what the BTC ATM operators should look for so their machine won't be another victim of the attack in the link below.

https://rottenwifi.com/ploutus-atm-malware-why-press-f3-for-money-was-really-an-atm-jackpotting-attack/
https://www.cyber.nj.gov/threat-landscape/malware/atm-malware/ploutus
Edit
It's something like this

[Dave1]

What is not reported is how they accessed the internals of the ATM's. You cannot just walk up to one and slip in a disk or plug in a keyboard...

Did they steal them? Have an inside man with access to the internals to plant the malware and plug in a Bluetooth keyboard dongle so they could later just drive up and do the thefts?

You have to check the second link that I attached here as there is the description on how the criminals attacks the ATM,

The Ploutus ATM malware family, first detected in 2013 by Symantec as Backdoor.Ploutus, allows attackers to withdraw cash from an ATM machine on command. The malware is installed by accessing the ATM’s CD-ROM drive and inserting a new boot disk that delivers the Ploutus variant. After connecting an external keyboard to the ATM machine, threat actors must press ‘F8’ to display the hidden trojan window. Once visible, numerous commands can be executed such as pressing ‘F1’ to generate ATM ID, ‘F2’ to activate ATM ID, and ‘F3’ to dispense cash.

So the attackers goes to the root, the ATM's CD-ROM and compromised it with a new boot disk that have the malware, then connecting a external keyboard to control everything. So there is no inside man, it's that the attack are sophisticated. Although there is still some questions on how they know the exploit to begin with. They could have a blue print of the machine itself to study and have someone with technical abilities to come up with this kind of exploits.