The U.S. Department of Justice announced the arrest of the man it alleges developed the Ploutus malware used in ATM jackpotting attacks that stole millions of dollars across the United States. Anibal Alexander Canelon Aguirre, 50, also known as "Prometheus" and "The Engineer," appeared in U.S. court following his arrest. In March 2026 he became the first cybercriminal placed on the FBI's Top 10 Most Wanted Fugitives list.
Court documents allege Canelon Aguirre and his accomplices deployed Ploutus between February 2024 and December 2025 to empty automated teller machines at banks and credit unions. Each incident caused financial losses exceeding $100,000, according to the Justice Department. More than $5.4 million was taken in at least 63 jackpottings against banks and another 54 against credit unions, with an additional $1,429,738 lost in attempted attacks. Members of the ring laundered the proceeds and moved them to accounts controlled by the Tren de Aragua Venezuelan gang in various countries.
The Justice Department said the malware included files with anti-analysis measures meant to obstruct forensic review, including software protection utilities designed to block reverse-engineering and debugging. Other files were built to delete the malware from an ATM's system, the department said, in an effort to conceal the deployment from financial institution employees. Canelon Aguirre is alleged to be the developer of Ploutus and one of the principal leaders of the jackpotting conspiracy.
Canelon Aguirre was charged in Nebraska in December 2025 with conspiracy to commit bank fraud, which carries a maximum sentence of 30 years in prison, and conspiracy to commit money laundering, which carries a maximum of 20 years. He also faces conspiracy to commit bank burglary and fraud in connection with computers, punishable by up to five years, and conspiracy to provide material support to terrorists, which carries a maximum of 15 years.
The Treasury Department designated Tren de Aragua a transnational criminal organization in July 2024, and the State Department designated it a foreign terrorist organization in February 2025. Last week, the Treasury's Office of Foreign Assets Control sanctioned eight Tren de Aragua members, including Canelon Aguirre, for their roles in jackpotting attacks on U.S. financial institutions.
The Justice Department said the gang has expanded throughout the Western Hemisphere and established a U.S. presence, engaging in crimes ranging from drug and firearms trafficking to kidnapping, robbery, fraud and extortion, as well as murder and assault. The department said the group added a revenue stream through financial crimes targeting U.S. institutions, and that the investigation found jackpotting attacks were targeted or carried out in 47 states, the District of Columbia and several foreign nations. Since October 2025, the department has charged 98 suspects in Tren de Aragua-linked jackpotting schemes, each facing maximum sentences of 20 to 335 years.
More cybersecurity news from TechManNews.
