PENTESTY · EDITORIAL ANALYSIS · · 4 min read
ATM jackpotting: who authorizes work on the cash machine?
A technician on site and a maintenance window do not establish permission for every change. Reviews need to connect the device, identity, authority and execution record.
By Pentesty
What was announced
On October 2, 2026, the US Department of Justice reported that Anibal Alexander Canelon Aguirre appeared in court and pleaded not guilty. Prosecutors allege that he developed Ploutus malware associated with unauthorized ATM cash dispensing. The charges remain to be adjudicated; statutory maximum penalties are not a sentence.
The cash machine is a chain of permissions
For a financial institution, the analysis begins before software. An intervention connects the device owner, the contractor, the assigned technician, the tools used and the approved change. Each link can appear legitimate in isolation while producing an action that nobody authorized from beginning to end.
A valid work order, for example, should not permit every possible modification. It needs to identify the device, time, task and limits. If a technician encounters an unexpected condition, authorization should return to the designated owner. This review also applies to third-party terminals or machines installed at locations with different operating teams.
Define the evidence before testing
Choose a small sample of recent interventions and ask the teams to reconstruct each one. Check whether another person can connect the request to its execution and final approval. A screenshot without a terminal identifier or time period provides little help when several suppliers work on the same network.
Record gaps as testable hypotheses. A missing document does not prove misconduct; it shows that the business could not substantiate a particular authorization. That distinction prevents a control review from becoming an accusation against a service provider.
- Connect the terminal identifier to the work order and the person responsible for approval.
- Check the individual identity used for maintenance and the permission’s expiry.
- Compare the approved change with the execution record and the configuration accepted at completion.
- Document who may stop the intervention and how service will resume.
Connect maintenance, alerts and reconciliation
An alert gains context when a team can compare it with an authorized intervention. Arrange a benign test event with the monitoring owner and confirm that the analyst identifies the terminal, consults the work order and contacts the right person. Avoid exposing customer data or credentials in shared records.
Include financial operations in completion checks. Responding to the network again and operating according to the accepted procedure are different acceptance criteria. The exercise should identify who verifies the terminal’s final condition and who makes decisions about downtime, customer service and preservation of the necessary records.
Turn findings into control decisions
Prioritize gaps according to the actions they permit and the reach of the permission. A shared account used across many terminals requires a different response from an incomplete approval in one ticket. Assign remediation an owner, a deadline and a way to verify the resulting condition.
During the retest, repeat the authorized scenario that exposed the process weakness. Also check whether the team can perform legitimate maintenance, because a restriction without an operational alternative can encourage exceptions. The assessment should produce an evidence-supported decision with clear limitations and a scheduled review.
Frequently asked questions
Was the defendant sentenced to 70 years?
The cited announcement reports charges and a not-guilty plea. Maximum penalties for criminal counts do not equal a conviction or the sentence a court might impose.
Must malware be executed to assess the control?
This review begins with documents, decisions and authorized simulations. Any additional technical testing needs a specific scope, an appropriate environment and stop conditions.
Who should participate in the assessment?
Terminal operations, security, supplier owners and change approvers. The person authorized to stop or resume the service also needs to be identified.
What evidence demonstrates remediation?
A retest connecting identity, task and permission to the expected behavior, supported by execution records and operational acceptance. The sample’s coverage should be explicit.
Sources and references
- U.S. Department of Justice: October 2, 2026 court appearance
- Cyber Security Brazil: editorial news reference
Original Pentesty analysis, published October 15, 2026. The proposed scenarios are editorial guidance, with scope and validation to be defined for each environment.