The alleged developer of the Ploutus ATM malware, tied to a multi-million dollar 'jackpotting' spree that drained cash machines across the United States, has appeared in court after his arrest, the Justice Department announced. Anibal Alexander Canelon Aguirre, 50, also known as 'Prometheus' and 'The Engineer,' was the first cybercriminal added to the FBI's Ten Most Wanted Fugitives list when he was placed on it in March 2026.
The U.S. Justice Department has announced the arrest of the alleged developer of Ploutus, a malware family used to steal millions of dollars in ATM jackpotting attacks across the United States.
According to court documents, Canelon Aguirre and his accomplices deployed Ploutus malware to empty bank and credit union ATMs in jackpotting attacks between February 2024 and December 2025. Financial losses surpassed $100,000 per incident, with more than $5.4 million stolen in at least 63 jackpotting attacks against banks and another 54 against credit unions, plus an additional $1,429,738 in attempted attacks. Members of the ring laundered the stolen funds and transferred them to accounts controlled by the Tren de Aragua (TdA) Venezuelan gang in various countries.
"Canelon Aguirre is alleged to be the developer of the Ploutus malware and one of the principal leaders of ATM jackpotting conspiracy," the Justice Department said, adding that the malware contained anti-analysis measures to hinder forensic review and files designed to delete the malware from compromised systems.
Canelon Aguirre was charged in Nebraska in December 2025 with conspiracy to commit bank fraud, conspiracy to commit money laundering, conspiracy to commit bank burglary and fraud in connection with computers, and conspiracy to provide material support to terrorists. The charges carry maximum sentences of 30, 20, five and 15 years respectively.
The Treasury Department designated TdA as a transnational criminal organization in July 2024, and the State Department has designated the gang as a foreign terrorist organization.
Analysis
Why This Matters
- The case shows ATM jackpotting remains a high-impact threat: the indictment ties more than $5.4 million in losses to attacks on at least 117 banks and credit unions in under two years.
- The FBI's decision to place a cybercriminal on its Ten Most Wanted Fugitives list for the first time marks a shift in how federal law enforcement ranks online crime.
- The alleged movement of laundered funds to Tren de Aragua highlights how cybercrime proceeds can bankroll a group the US has designated a transnational criminal organization.
Background
ATM jackpotting is a form of cybercrime in which attackers use malware or other tools to force cash machines to dispense cash. The Ploutus family is one of the better-known names in this corner of the cybercrime world. Tren de Aragua began as a Venezuelan prison gang and has grown into a transnational criminal organization with operations across the Americas. The FBI's Ten Most Wanted Fugitives list has historically centered on fugitives wanted for violent crimes, making the addition of an alleged cybercriminal notable. All charges remain allegations unless proven in court.
Key Perspectives
Law enforcement (FBI, Justice Department): Federal prosecutors paired financial crime counts with a terrorism support charge, reflecting their view that the alleged conspiracy crosses into national security territory. The DOJ also stressed the malware's anti-analysis measures, describing the operation as sophisticated.
Banks and credit unions: The victims absorbed direct cash losses and face the cost of hardening ATM fleets. The scale of the alleged scheme, more than 100 successful jackpotting incidents, underscores how much is at stake.
Defense and the courts: The defendant is presumed innocent, and the prosecution will need to prove he developed Ploutus and led the conspiracy, not merely that the malware was used in the attacks.
Critics and skeptics: The indictment refers to accomplices, and the full extent of the network, including how much of the money reached Tren de Aragua, has not been made public. Questions may also arise about how such jackpotting campaigns could run for nearly two years before arrests.
What to Watch
- Whether Canelon Aguirre is convicted and what sentence he receives; the charges carry a combined maximum of 70 years in prison.
- Whether US authorities announce additional arrests of the alleged accomplices named in the indictment.
- Whether financial institutions respond by upgrading ATM security, and whether similar malware families remain active in the meantime.