FBI Arrests ‘Most Wanted’ Developer of Ploutus ATM Malware
FBI arrested Ploutus developer Anibal Canelon Aguirre, accused of leading Tren de Aragua ATM jackpotting.
The FBI arrested Anibal Alexander Canelon Aguirre, 50, a Venezuelan national known as Prometheus and The Engineer, accused of leading Tren de Aragua ATM jackpotting and developing Ploutus malware. He appeared in a US court on October 2, 2026, pleaded not guilty, and remains detained; the Treasury sanctioned him the week before, and he had been on the FBI top 10 most-wanted list since March 2026. Authorities say operators exploited ATM flaws to deploy Ploutus, which can resist analysis and erase itself, forcing machines to dispense cash across 47 states, D.C., and other countries. He was indicted in December 2025 with 21 others; 120 defendants have been charged and three sentenced.
- Canelon Aguirre faces charges tied to Ploutus ATM jackpotting for Tren de Aragua.
- He was on the FBI top 10 list and was sanctioned by Treasury.
- Ploutus makes ATMs dispense cash and can delete itself after use.
- US officials link the scheme to attacks in 47 states and abroad.
- Authorities have charged 120 defendants and sentenced three to prison.
Full article336 words · extracted from securityweek.com · click to collapse
A Venezuelan national believed to be a leader of Tren de Aragua (TdA)’s ATM jackpotting activities and the developer of the infamous Ploutus ATM malware has been arrested.
According to the US, TdA is a violent transnational criminal organization that engages in different types of trafficking, robbery, fraud, extortion, and various types of financial crimes targeting US organizations, including ATM jackpotting.
The organization is blamed for ATM jackpotting attacks across 47 states, the District of Columbia, and foreign countries.
On October 2, Anibal Alexander Canelon Aguirre, 50, also known as ‘Prometheus’ and ‘The Engineer’, who was sanctioned last week by the US Treasury, appeared in court to face charges associated with his role in TdA.
He has been on the FBI’s top 10 most wanted fugitives list since March 2026, becoming the first individual added to that list for cybercrimes.
Canelon Aguirre was indicted in the US in December 2025 along with 21 other individuals for bank burglary, fraud, and money laundering conspiracy.
Advertisement. Scroll to continue reading.
The US has not shared details on how he was apprehended, but noted that he will remain detained pending trial, after entering not guilty pleas.
According to the US, Canelon Aguirre is one of the masterminds behind the ATM jackpotting attacks carried out by TdA using Ploutus.
Members of the operation exploited vulnerabilities in ATMs to deploy the malware, which allowed them to force the systems to dispense cash without debiting accounts.
Ploutus contained anti-analysis capabilities to hinder forensic analysis and could also erase itself from the infected systems to hide its tracks.
To date, 120 defendants have been charged for their roles in the conspiracy, and three of them have been sentenced to prison: Oddry Arnoldo Cabrera Torrealba, Carlos Javier Padron, and Juan Manuel Gouveia Aguilera.
Related: Alleged ShinyHunters Leader Arrested in Jordan
Related: In Rare Move, Alleged Iranian State Hacker Extradited to US
Related: Police Shut Down KillSec Ransomware, Identify Alleged Teen Leader
Related: Prison Sentence for Former US Soldier Who Hacked AT&T and Verizon