Alleged Ploutus developer pleads not guilty in Nebraska

Anibal Canelon Aguirre, alleged Ploutus ATM-malware developer tied to Tren de Aragua, pleaded not guilty in Nebraska and remains detained.

The Justice Department and FBI say 50-year-old Venezuelan Anibal Alexander Canelon Aguirre, also known as Prometheus and The Engineer, was arrested and appeared in Nebraska federal court on October 2, 2026, where he pleaded not guilty and remains detained. He is accused of developing Ploutus ATM malware and leading a Tren de Aragua jackpotting conspiracy; outlets describe Nebraska charges that include bank fraud, money laundering, bank burglary, computer fraud, and material support to terrorists, and The Record says he faces up to 70 years if convicted. From February 2024 through December 2025 his alleged group targeted at least 63 bank ATMs and 54 credit-union ATMs—117 attacks in The Record’s count—stealing more than $5.4 million, with another $1,429,738 attempted. Sources give different wider totals: The Record says Ploutus was used in at least 1,500 attacks causing $40.7 million in losses, while BleepingComputer quotes the FBI as saying ATM hacking stole more than $20 million in 2025. SecurityWeek says activity spanned 47 states, Washington, D.C., and other countries, that he was indicted in December 2025 with 21 others, and that Ploutus can resist analysis and erase itself after forcing cash to dispense. Charged-person counts also disagree—98 related suspects since October 2025 versus 120 defendants charged, with three sentenced—and he was on the FBI Ten Most Wanted list from March 2026, which Dark Reading calls a first for a cybercriminal, while Treasury/OFAC sanctioned him among Tren de Aragua associates.

• Anibal Alexander Canelon Aguirre, 50, a Venezuelan national also known as Prometheus and The Engineer, pleaded not guilty in Nebraska federal court on October 2, 2026, and remains detained.
• He is accused of developing Ploutus ATM malware and leading Tren de Aragua jackpotting; reported charges include bank fraud, money laundering, bank burglary, computer fraud, and material support to terrorists, with one outlet citing up to…
• From February 2024 through December 2025 his alleged group hit at least 63 bank ATMs and 54 credit-union ATMs (117 attacks), stealing more than $5.4 million, with another $1,429,738 attempted.
• Broader loss figures differ by scope: The Record cites at least 1,500 Ploutus attacks and $40.7 million in losses; BleepingComputer cites the FBI saying ATM hacking stole more than $20 million in 2025.
• SecurityWeek says the scheme reached 47 states, Washington, D.C., and other countries, and that he was indicted in December 2025 with 21 others.
• Defendant totals conflict: 98 related suspects charged since October 2025 (BleepingComputer) versus 120 charged and three sentenced (SecurityWeek and The Record).
• He was on the FBI Ten Most Wanted list from March 2026; Dark Reading calls him the first cybercriminal on that list. Treasury/OFAC sanctioned him among Tren de Aragua associates.