Alleged Tren de Aragua ATM Malware Leader Arrested in Jackpotting Case
Summary
US authorities arrested and charged Anibal Alexander Canelon Aguirre, accused of developing Ploutus-D and leading a Tren de Aragua ATM jackpotting scheme that allegedly stole $5.1 million from US banks and laundered proceeds through cryptocurrency.
Key points
- Canelon Aguirre, also known as “Prometheus” and “The Engineer,” was arrested at sea and arraigned on charges including conspiracy to commit bank fraud and provide material support to terrorists.
- The indictment attributes more than $5.1 million in thefts from 117 US banks and credit unions between 2024 and 2025 to the group.
- Authorities allege cartel members physically installed Ploutus-D malware in ATMs to make them dispense cash, which money mules collected.
- The malware’s reported capabilities include terminating security processes, dispensing cash, and deleting traces; it can work across ATM models using the Kalignite platform.
- Investigators and blockchain-analysis firms say proceeds were laundered through cryptocurrency networks, including TRON; seven related addresses were sanctioned.
- OFAC cited more than 1,500 jackpotting incidents and $40.7 million stolen as of August 2025, indicating the problem extends beyond the alleged cartel scheme.
Article Details
- Event Type
- Arrest and arraignment of a Tren de Aragua member accused of developing and using ATM jackpotting malware in a cash-theft and money-laundering scheme.
- Impact
- The indictment attributes more than $5.1 million stolen from 117 US banks and credit unions in 2024 and 2025 to Tren de Aragua. US authorities allege the scheme used Ploutus-D to compromise ATMs and dispense cash, with proceeds laundered through cryptocurrency networks. Separately, OFAC reported more than 1,500 jackpotting incidents resulting in $40.7 million stolen as of August 2025.
People
Anibal Alexander Canelon AguirreArrested and arraigned on charges related to the ATM jackpotting scheme; authorities allege he was a Tren de Aragua leader and the principal architect of Ploutus-D. Also known as “Prometheus” and “The Engineer.”Ari RedbordTRM Labs global head of policy who commented on the alleged use of ATM malware and TRON for terrorist financing.Eugene KowelFBI Omaha special agent in charge who commented on the investigation and Canelon Aguirre’s capture and arraignment.Jorge FigueiraVenezuelan national associated with a cryptocurrency network that received approximately $35 million from the referenced addresses; charged by the United States with laundering approximately $1 billion in illicit funds.Kaitlin MartinChainalysis senior intelligence analyst who commented on criminal organizations’ use of shared cryptocurrency infrastructure for laundering.Lesley A. WoodsUnited States Attorney who described the District of Nebraska’s investigation and prosecution.
Threat Actors
Malware
Ploutusknown as "Prometheus" and "The Engineer" — is a leader in the cartel, and the principal architect of the Ploutus-D malware used to compromise and control the ATMs targeted in the scheme, according to the US Attorney'sPloutus-Das "Prometheus" and "The Engineer" — is a leader in the cartel, and the principal architect of the Ploutus-D malware used to compromise and control the ATMs targeted in the scheme, according to the US Attorney's
Vendors
Products
Countries
Colombiafor laundering the stolen cash, utilizing infrastructure created by criminal organizations in Colombia, Mexico, and Venezuela, according to a breakdown by Chainalysis, a blockchain-intelligence firm.Mexicoas a prison gang but has evolved into a multinational criminal enterprise based mainly in Venezuela and Mexico. Cybercrime, experts say, is increasingly part of the cartel mix in general as a convenient and stealthyUnited StatesLatin and North America, with more than $5.1 million stolen from 117 banks and credit unions in the United States in 2024 and 2025, according to the original indictment of Canelon Aguirre and other members of theVenezuelabegan as a prison gang but has evolved into a multinational criminal enterprise based mainly in Venezuela and Mexico. Cybercrime, experts say, is increasingly part of the cartel mix in general as a convenient