FBI arrests alleged Ploutus ATM malware developer

The FBI arrested alleged Ploutus developer Anibal Canelon Aguirre, who pleaded not guilty in Nebraska and remains detained.

The FBI arrested Anibal Alexander Canelon Aguirre, 50, a Venezuelan national known as Prometheus and The Engineer, accused of developing Ploutus ATM malware and leading Tren de Aragua ATM jackpotting. He appeared in a U.S. court on October 2, 2026, pleaded not guilty in federal court in Nebraska, and remains detained. The Record says the charges include conspiracy, computer fraud, money laundering, and material support, with up to 70 years if convicted, while that outlet's points also list bank fraud. SecurityWeek says he was indicted in December 2025 with 21 others, had been on the FBI top 10 most-wanted list since March 2026, and was sanctioned by the Treasury the week before; Dark Reading calls him the first cybercriminal on that list and says the activity allegedly funded the group's violent operations, but does not name him or Ploutus. Officials link Ploutus, described as able to resist analysis and erase itself, to cash-outs in 47 states, Washington, D.C., and other countries; The Record reports at least 1,500 attacks and $40.7 million in losses, plus 117 attacks by his alleged group from February 2024 through December 2025 taking more than $5.4 million. SecurityWeek and The Record both say 120 people have been charged, and only SecurityWeek says three have been sentenced; DataBreaches.net confirms the Nebraska plea and detention but does not name the malware.