THREATNOIR
Subscribe
Back to advisories

Alleged dev of Ploutus ATM malware appears in US court after arrest

Ploutus ATM malware developer arrested after stealing $5.4M from ATMs between Feb 2024-Dec 2025 for Tren de Aragua gang. While the threat actor is in custody, variant samples and TTPs remain active in the wild. Organizations managing ATM networks or processing ATM transaction data need immediate visibility into potential compromise.

HIGHAdvisoryOct 06, 2026
Action required
Hunt for Ploutus indicators: scan ATM systems and connected terminals for known malware signatures. Review ATM transaction logs for anomalous cash dispensing patterns, especially bulk withdrawals with minimal authentication. Block known C2 infrastructure and monitor for new variant activity.
Linked articles
Source links