Alleged ATM malware creator appears in Nebraska court after arrest

The alleged mastermind behind a strain of malware used to empty ATMs of millions of dollars appeared in court for the first time after being apprehended by federal authorities. 

Anibal Alexander Canelon Aguirre pleaded not guilty to several charges in a Nebraska district court on Friday and will remain in detention pending his trial. 

For months, the FBI has claimed Aguirre was the mastermind behind the Ploutus malware — a powerful tool used by criminals to steal money from ATMs. Criminals open the top of an ATM, link it to a personal device and install the malware, allowing them to forcibly empty the machine of all its cash. 

The Justice Department has arrested, charged and secured convictions for dozens of people involved in the scheme — known as ATM jackpotting. Aguirre was added to the FBI’s “Top 10 Most Wanted Fugitives” list in March, becoming the first cybercriminal added to the list. 

Known as “Prometheus” and “The Engineer,” the 50-year-old Venezuelan national has eluded capture since the Justice Department began indicting people involved in the ATM jackpotting scheme. 

A Justice Department spokesperson was tightlipped on the nature of Aguirre’s arrest, declining to say when or where he was detained.  

FBI Director Kash Patel said Aguirre is now “back in the United States to face justice” and repeatedly mentioned the “fugitive’s return to the United States.”

A DOJ spokesperson explained that it would be “inaccurate” to say Aguirre was extradited and when pressed confirmed that Aguirre was not in the United States but was not extradited. They declined to explain how Aguirre was legally returned to the U.S. Fox News reported that he was arrested in Venezuela last month. 

“Anibal Canelon Aguirre served as a key architect of sophisticated malware used to drain ATMs of cash across the United States — technology that helped fuel the criminal operations of the violent transnational organization Tren de Aragua (TdA),” said Assistant Attorney General A. Tysen Duva. 

Aguirre was indicted by a federal grand jury in Nebraska last December and was charged with conspiracy to commit bank fraud, conspiracy to commit bank burglary and fraud in connection with computers, money laundering and providing material support to terrorists. 

He is facing up to 70 years in prison if convicted. 

U.S. officials have tracked at least 1,500 total ATM jackpotting attacks, causing $40.7 million in losses.

Cybersecurity experts who have been tracking the Ploutus malware for more than a decade have not been able to verify whether Aguirre is the true developer of the malware. It is one of the most advanced ATM-focused malware strains and various versions of it have been used against ATMs across Latin America and the U.S. since 2013. 

U.S. officials have sought to tie many of the ATM jackpotting attacks to Tren de Aragua, a Venezuelan criminal group.

The proceeds of ATM thefts were allegedly transferred to Tren de Aragua members who helped conceal their origin, either through cryptocurrency or by laundering the funds through companies they own in Mexico and elsewhere. 

The Justice Department has repeatedly claimed there are “extensive direct and indirect links” between the Ploutus malware used in the ATM jackpotting scheme and Tren de Aragua.

The ATM jackpotting scheme was lucrative for Aguirre, with he and others conducting 117 ATM jackpotting attacks on banks and credit unions between February 2024 and December 2025. The group typically targeted ATMs in remote locations like Nebraska and other U.S. states.

The group earned more than $5.4 million from the attacks between 2024 and 2025. Aguirre typically tasked others with driving to the ATMs and opening them before remotely installing the malware on the machines. Those who conducted the attacks in person kept a percentage of the proceeds before delivering the rest to Aguirre and other more senior figures in the operation. 

Last week, the Treasury Department sanctioned Aguirre and several others who used businesses and other tools to launder the proceeds of the ATM jackpotting scheme. 

In total, 120 people have been charged for participating in the ATM jackpotting scheme.