Alleged Ploutus ATM Malware Developer Appears in US Court

The alleged developer of Ploutus ATM malware has appeared in a Nebraska federal court following his arrest. US authorities accuse Anibal Alexander Canelon Aguirre of helping lead a scheme that stole millions from cash machines.

Canelon Aguirre, 50, also uses the names “Prometheus” and “The Engineer,” according to investigators. Prosecutors link the alleged operation to Tren de Aragua, a Venezuelan criminal organization.

Prosecutors Detail Millions in ATM Thefts

Court documents describe attacks between February 2024 and December 2025, during which suspects allegedly installed malware to force ATMs to dispense cash. Criminals commonly call this technique “jackpotting.”

According to prosecutors, the operation stole more than $5.4 million through at least 63 attacks against banks and 54 against credit unions. Meanwhile, attempted thefts involved a further $1,429,738.

Individual incidents could cause losses exceeding $100,000. After collecting the cash, members allegedly laundered the proceeds and transferred funds to accounts controlled by Tren de Aragua in several countries.

However, these figures relate to the alleged operation described in the case. They do not represent the total losses from ATM malware attacks across the United States.

Ploutus ATM Malware Allegedly Included Concealment Tools

Investigators identify Canelon Aguirre as both the alleged malware developer and one of the conspiracy’s principal leaders.

The Justice Department says Ploutus ATM malware included protections designed to obstruct forensic examination. Specifically, those features made it harder for analysts to reverse-engineer or debug the software.

In addition, other components could remove the malware from infected machines. Prosecutors allege that these functions helped conceal the intrusions from financial institution employees.

The accusations therefore extend beyond cash collection to the development and management of the tools behind the attacks.

Nebraska Charges Carry Lengthy Potential Sentences

Federal prosecutors charged Canelon Aguirre in December 2025 with several conspiracy offenses.

The bank fraud conspiracy charge carries a maximum prison term of 30 years. Meanwhile, the money laundering conspiracy charge carries up to 20 years.

He also faces a charge involving conspiracy to commit bank burglary and computer fraud, with a maximum five-year sentence. A further charge alleging conspiracy to provide material support to terrorists carries up to 15 years.

These are statutory maximum penalties, rather than sentences the court has imposed. The allegations remain unproven unless established in court.

In March 2026, the FBI added Canelon Aguirre to its Ten Most Wanted Fugitives list.

Investigation Extends Across 47 States

Authorities say the broader conspiracy targeted or carried out ATM jackpotting attacks in 47 states and Washington, DC. Investigators also identified activity in several foreign countries.

The US Treasury designated Tren de Aragua as a transnational criminal organization in July 2024. Subsequently, the State Department designated it as a foreign terrorist organization in February 2025.

Separately, the Treasury’s Office of Foreign Assets Control sanctioned eight alleged members over their roles in ATM jackpotting. Canelon Aguirre was among those named.

Since October 2025, the Justice Department has charged 98 suspects in jackpotting schemes allegedly connected to the group.

Meanwhile, an FBI warning issued in February put nationwide losses from ATM hacking attacks above $20 million during 2025. That broader figure provides context for the growing threat, but it is separate from the losses alleged in this case.