Federal prosecutors have secured the arrest of a man accused of developing Ploutus, a malicious software tool used in coordinated attacks against automated teller machines throughout the United States. The suspect, identified as 50-year-old Anibal Alexander Canelon Aguirre, operated under aliases including "Prometheus" and "The Engineer." He became the first person added to the FBI's "Top 10 Most Wanted Fugitives" list when he was listed in March 2026.
Court filings reveal that Canelon Aguirre and associates deployed the Ploutus malware to compromise ATMs operated by banks and credit unions between February 2024 and December 2025. The scheme resulted in losses exceeding $100,000 per successful attack, with documented theft totaling more than $5.4 million across at least 63 incidents at bank ATMs and 54 at credit union machines. An additional $1,429,738 was lost in attempted jackpotting operations.
Proceeds from the thefts were funneled through money laundering channels and ultimately directed to accounts managed by Tren de Aragua (TdA), a Venezuelan criminal organization, in multiple countries.
Malware capabilities and design
The Justice Department characterized Canelon Aguirre's role in a statement: "Canelon Aguirre is alleged to be the developer of the Ploutus malware and one of the principal leaders of ATM jackpotting conspiracy. Ploutus malware consisted of, among other things, files that contained anti-analysis measures to hinder forensic review, specifically software protection utilities to prevent reverse-engineering and debugging."
Prosecutors noted additional functionality built into the code: "The malware also contained other files that served the function of deleting the malware from the system in an effort to conceal, create a false impression, mislead, or otherwise deceive employees of the financial institution from learning about the deployment of the malware on the ATM."
Criminal charges and sentencing exposure
Canelon Aguirre was charged in Nebraska in December 2025 with multiple federal offenses carrying substantial prison time. The charges include:
- Conspiracy to commit bank fraud (maximum 30 years)
- Conspiracy to commit money laundering (maximum 20 years)
- Conspiracy to commit bank burglary and fraud in connection with computers (maximum 5 years)
- Conspiracy to provide material support to terrorists (maximum 15 years)
Tren de Aragua designation and sanctions
The U.S. Treasury Department formally designated TdA as a transnational criminal organization in July 2024, followed by the State Department's designation as a foreign terrorist organization in February 2025. Last week, the Office of Foreign Assets Control (OFAC) imposed sanctions on eight TdA members, including Canelon Aguirre, for their participation in the ATM jackpotting campaign.
Federal authorities described the scope of TdA's criminal enterprise: "TdA has expanded its criminal network throughout the Western Hemisphere and established a presence in the United States. TdA's criminal activities range from drug trafficking and firearms trafficking to commercial sex trafficking, kidnapping, robbery, theft, fraud, and extortion. TdA members also commit murder, assault, and other violent acts to advance the organization's criminal activities."
The Justice Department further noted: "TdA has also developed an additional source of revenue stream through financial crimes that target financial institutions throughout the United States, including using ATM jackpotting to steal millions of dollars in cash. The investigation has revealed that the conspiracy has targeted or carried out ATM jackpotting attacks in 47 states, the District of Columbia, and several foreign nations."
Broader enforcement action
Since October 2025, the Justice Department has brought charges against 98 individuals implicated in ATM jackpotting operations connected to TdA. These defendants collectively face maximum sentences ranging from 20 to 335 years in prison.
The crackdown follows a warning issued by the FBI in February regarding a dramatic escalation in ATM theft. Criminals stole more than $20 million through ATM hacking attacks during 2025 alone, marking a significant surge in this category of financial crime.