Alleged Ploutus ATM Malware Developer Arrested in the US
Summary
Anibal Alexander Canelon Aguirre, accused of helping lead Tren de Aragua’s ATM jackpotting operation and developing Ploutus malware, appeared in US court after his arrest and pleaded not guilty.
Key points
- Canelon Aguirre, also known as “Prometheus” and “The Engineer,” was added to the FBI’s most-wanted list in March 2026.
- US authorities accuse him of helping mastermind Tren de Aragua ATM jackpotting attacks using Ploutus.
- The malware enabled ATMs to dispense cash without debiting accounts and included anti-analysis and self-erasure capabilities.
- He was indicted in December 2025 with 21 others on bank burglary, fraud, and money laundering conspiracy charges.
- He will remain detained pending trial; authorities have not disclosed how he was apprehended.
- The article says 120 defendants have been charged in the conspiracy, and three have received prison sentences.
Article Details
- Event Type
- Arrest of an alleged developer and leader involved in ATM jackpotting attacks using Ploutus malware.
- Impact
- The attacks reportedly used Ploutus to make ATMs dispense cash without debiting accounts. The organization is blamed for ATM jackpotting attacks across 47 US states, the District of Columbia, and foreign countries.
People
Anibal Alexander Canelon AguirreAlleged Ploutus developer and one of the masterminds behind Tren de Aragua ATM jackpotting attacks; also known as “Prometheus” and “The Engineer.”Carlos Javier PadronOne of three individuals named in the article as sentenced to prison for roles in the conspiracy.Juan Manuel Gouveia AguileraOne of three individuals named in the article as sentenced to prison for roles in the conspiracy.Oddry Arnoldo Cabrera TorrealbaOne of three individuals named in the article as sentenced to prison for roles in the conspiracy.