Alleged Ploutus Malware Figure Pleads Not Guilty in Nebraska ATM Jackpotting Case
Summary
Anibal Alexander Canelon Aguirre pleaded not guilty in Nebraska to charges tied to an alleged ATM jackpotting scheme using Ploutus malware. Authorities report 1,500 attacks and $40.7 million in losses; experts have not verified he developed the malware.
Key points
- Aguirre pleaded not guilty to charges including bank fraud conspiracy, bank burglary conspiracy, computer fraud, money laundering, and providing material support to terrorists; he remains detained pending trial.
- Authorities allege he was a key figure behind Ploutus, malware used to force ATMs to dispense cash after criminals physically opened machines and connected a personal device.
- Officials say the broader scheme caused at least 1,500 attacks and $40.7 million in losses across the United States and Latin America; 120 people have been charged.
- Prosecutors allege Aguirre directed others to carry out ATM attacks and that proceeds were laundered through cryptocurrency and businesses.
- Authorities link the scheme to Tren de Aragua, while cybersecurity experts have not verified whether Aguirre was Ploutus’s developer.
- Aguirre faces up to 70 years in prison if convicted; the article says the circumstances of his return to the United States remain unclear.
Article Details
- Event Type
- Court appearance and criminal charges involving alleged ATM jackpotting and Ploutus malware activity.
- Impact
- U.S. officials report at least 1,500 ATM jackpotting attacks and $40.7 million in losses across the United States and Latin America. The article also reports 117 attacks on banks and credit unions between February 2024 and December 2025, generating more than $5.4 million, and 120 people charged. Anibal Alexander Canelon Aguirre pleaded not guilty and remains detained pending trial.
People
A. Tysen DuvaAssistant Attorney General who described Aguirre as a key architect of malware used to drain ATMs.Anibal Alexander Canelon AguirreAlleged key figure behind Ploutus and mastermind of ATM jackpotting attacks; pleaded not guilty and remains detained pending trial. Also known as “Prometheus” and “The Engineer.”Kash PatelFBI Director who said Aguirre had returned to the United States to face justice.
Threat Actors
Malware
Countries
Mexicotheir origin, either through cryptocurrency or by laundering the funds through companies they own in Mexico and elsewhere.United Statesauthorities say the scheme, linked to Tren de Aragua, has resulted in 1,500 attacks and more than $40.7 million in losses across the United States and Latin America.VenezuelaFox News reported that he was arrested in Venezuela last month.