Security1 publisher2 min readPublished
US arrest removes the alleged author of Ploutus from a $5.4 million ATM jackpotting ring
US authorities arrested Anibal Alexander Canelon Aguirre, alleged developer of Ploutus ATM malware, over $5.4 million stolen in 117 jackpottings. Prosecutors say jackpotting earned money for Tren de Aragua and hit ATMs in 47 states.
The Watch · Security desk
Drafted by a language model from the sources cited here and checked against its claim ledger before publication. How we use AISend a correction
What happened
- He was charged in Nebraska in December 2025 with conspiracy counts covering bank fraud, money laundering, bank burglary and computer fraud, and material support to terrorists.
- Prosecutors say Ploutus included files that deleted it from the ATM so the institution's employees would not learn it had been deployed.
- The Justice Department has charged 98 people in Tren de Aragua-linked jackpotting schemes since October 2025.
Compiled by The WatchSomething wrong?How this is made
Why it matters
- constraint A bank or credit union examining an emptied machine may find the malware already gone, and any sample it does recover was built to resist debugging and reverse-engineering.
- precedent With Tren de Aragua designated a terrorist group, a jackpotting developer faces a 15-year material-support count beside the fraud charges, and other defendants in linked schemes can expect the same.
- decision Banks and credit unions have to decide whether the arrest changes their ATM defenses. Because accomplices deployed the malware, the evidence supports keeping Ploutus in the threat model.
The dollar figures in the case do not line up cleanly. More than $5.4 million across at least 117 jackpottings [4][19] works out to about $46,000 per attack [22]. The same account of the court documents puts losses above $100,000 per incident [21]. Both can be true only if the per-incident figure includes losses beyond the cash taken. Attempted attacks add another $1,429,738 [5].
The Justice Department's technical description of Ploutus is about concealment. "Ploutus malware consisted of, among other things, files that contained anti-analysis measures to hinder forensic review, specifically software protection utilities to prevent reverse-engineering and debugging," the department said in a Friday press release [8]. It calls Canelon Aguirre, 50, both the alleged developer and "one of the principal leaders of ATM jackpotting conspiracy" [7][2].
Sanctions and designations came before the arrest. Prosecutors say the ring laundered the cash and moved it to accounts controlled by Tren de Aragua in several countries [6]. Treasury designated the gang a transnational criminal organization in July 2024 [11], and the State Department named it a foreign terrorist organization in February 2025 [12]. In March 2026 the FBI made Canelon Aguirre, also known as "Prometheus" and "The Engineer," the first cybercriminal on its Top 10 Most Wanted Fugitives list [2]. Last week the Office of Foreign Assets Control sanctioned him and seven other Tren de Aragua members over jackpotting attacks on US financial institutions [13].
The FBI's count of the wider problem is larger than this case. In February it warned that criminals stole more than $20 million through ATM attacks in 2025 [17]. That is about 3.7 times the total charged to this conspiracy over its whole run [20]. Court documents describe Canelon Aguirre deploying Ploutus with accomplices [3]. Defendants in the linked schemes face maximum sentences of 20 to 335 years each [16]. For a bank or credit union, the alleged author's arrest still leaves the deployed copies unresolved: the record as reported does not say whether any were recovered, or whether any were used after December 2025.
What to watch
- Any FBI or Justice Department statement on Ploutus activity after December 2025, or on copies recovered from charged defendants.
- Canelon Aguirre's plea and later hearings on the Nebraska charges, including the material-support count.
- Further OFAC designations of Tren de Aragua members tied to jackpotting beyond the eight named last week.