Ploutus ATM Malware: Arrest of Alleged Developer and Disruption of Tren de Aragua
In March 2024, the FBI added Aníbal Canelon Aguirre, alleged lead developer of the Ploutus ATM malware family (variants Ploutus.D and Ploutus.E), to its Top 10 Most Wanted Fugitives list; he was apprehended in Nebraska and charged with facilitating a transnational jackpotting campaign linked to the Venezuelan Tren de Aragua gang. Ploutus malware forces ATMs to dispense cash via USB or network‑based delivery, interacting with XFS/CEN/XFS middleware to issue cash‑dispense commands, employing obfuscation, packing, encryption, and a C2 infrastructure for remote activation. The arrest disrupted a key node of the Tren de Aragua cybercrime network and halted ongoing Ploutus‑based jackpotting operations targeting ATMs across the United States and Latin America.