FlagThis — Daily Cybersecurity Intelligence Briefing

In March 2024, the FBI added Aníbal Canelon Aguirre, alleged lead developer of the Ploutus ATM malware family (variants Ploutus.D and Ploutus.E), to its Top 10 Most Wanted Fugitives list; he was apprehended in Nebraska and charged with facilitating a transnational jackpotting campaign linked to the Venezuelan Tren de Aragua gang. Ploutus malware forces ATMs to dispense cash via USB or network‑based delivery, interacting with XFS/CEN/XFS middleware to issue cash‑dispense commands, employing obfuscation, packing, encryption, and a C2 infrastructure for remote activation. The arrest disrupted a key node of the Tren de Aragua cybercrime network and halted ongoing Ploutus‑based jackpotting operations targeting ATMs across the United States and Latin America.

Threat actor UNC2891 executed "Pi Heist" attacks by gaining physical access to bank ATM internals to deploy Raspberry Pi devices equipped with 4G LTE modems. By establishing a Layer 2 bridge between the internal ATM VLAN and an external Command-and-Control (C2) server, the attackers bypassed perimeter firewalls and Network Access Control (NAC). This persistent hardware backdoor allowed the adversary to pivot through the trusted network segment and issue unauthorized "dispense" commands directly to ATM cash dispensers, resulting in direct financial theft via jackpotting.