Alleged dev of Ploutus ATM malware appears in US court after arrest

The U.S. Department of Justice has announced the arrest of the alleged developer of Ploutus malware, used to steal millions of dollars in ATM jackpotting attacks across the United States.

Also known as "Prometheus" and "The Engineer," 50-year-old Anibal Alexander Canelon Aguirre was the first cybercriminal added to the FBI's "Top 10 Most Wanted Fugitives" list in March 2026.

According to court documents, Canelon Aguirre and his accomplices deployed Ploutus malware and emptied bank and credit union automated teller machines (ATMs) in jackpotting attacks between February 2024 and December 2025.

Financial losses after these attacks surpassed $100,000 per incident, with more than $5.4 million stolen in at least 63 ATM jackpottings targeting banks and another 54 against credit unions, plus an additional $1,429,738 in attempted attacks.

The criminal ring's members laundered the stolen funds and then transferred them to accounts controlled by the Tren de Aragua (TdA) Venezuelan gang in various countries.

"Canelon Aguirre is alleged to be the developer of the Ploutus malware and one of the principal leaders of ATM jackpotting conspiracy. Ploutus malware consisted of, among other things, files that contained anti-analysis measures to hinder forensic review, specifically software protection utilities to prevent reverse-engineering and debugging," the Justice Department said in a Friday press release.

"The malware also contained other files that served the function of deleting the malware from the system in an effort to conceal, create a false impression, mislead, or otherwise deceive employees of the financial institution from learning about the deployment of the malware on the ATM."

​Canelon Aguirre was charged in Nebraska in December 2025 with several offenses: conspiracy to commit bank fraud (which carries a maximum sentence of 30 years in prison), conspiracy to commit money laundering (with a maximum sentence of 20 years), conspiracy to commit bank burglary and fraud in connection with computers (which could result in a five-year sentence), and a charge of conspiracy to provide material support to terrorists that carries a maximum of 15 years.

The U.S. Treasury Department designated TdA as a transnational criminal organization in July 2024, and the Department of State designated it as a foreign terrorist organization in February 2025.

Last week, the U.S. Office of Foreign Assets Control (OFAC) also sanctioned eight TdA members (including Canelon Aguirre) for their roles in jackpotting attacks targeting U.S. financial institutions.

"TdA has expanded its criminal network throughout the Western Hemisphere and established a presence in the United States. TdA's criminal activities range from drug trafficking and firearms trafficking to commercial sex trafficking, kidnapping, robbery, theft, fraud, and extortion. TdA members also commit murder, assault, and other violent acts to advance the organization's criminal activities," the Justice Department said in a Friday press release.

"TdA has also developed an additional source of revenue stream through financial crimes that target financial institutions throughout the United States, including using ATM jackpotting to steal millions of dollars in cash. The investigation has revealed that the conspiracy has targeted or carried out ATM jackpotting attacks in 47 states, the District of Columbia, and several foreign nations."

Since October 2025, the Justice Department has charged 98 suspects involved in ATM jackpotting schemes linked to the TdA gang. They now face maximum sentences ranging from 20 to 335 years in prison each.

After a wave of arrests targeting members of the TdA criminal organization, the FBI also warned in February that criminals had stolen more than $20 million in 2025 in a massive surge of ATM hacking attacks.