FBI Nabs Developer Behind Ploutus ATM Malware in Tren de Aragua Takedown

The FBI has arrested a Venezuelan national it describes as a senior figure in Tren de Aragua's ATM jackpotting operation and the person responsible for building the Ploutus malware that made it all possible.

Anibal Alexander Canelon Aguirre, 50, known by the handles 'Prometheus' and 'The Engineer', appeared in court on October 2 to face charges tied to his alleged leadership role in the gang's financial crimes division. He pleaded not guilty and will stay behind bars until trial.

Canelon Aguirre holds the distinction of being the first person added to the FBI's top 10 most wanted fugitives list specifically for cybercrime, landing there in March 2026. The US Treasury sanctioned him around the same time. He was originally indicted back in December 2025, alongside 21 co-defendants, on charges including bank burglary, fraud, and money laundering conspiracy.

Tren de Aragua is a Venezuelan criminal organisation the US government classifies as a violent transnational gang. Among its various rackets, the group has been running ATM jackpotting attacks across 47 US states, Washington DC, and multiple foreign countries. Jackpotting, for the uninitiated, involves forcing cash machines to spit out money without touching any linked bank account.

Ploutus, the malware at the centre of all this, is not a crude tool. It was built to exploit vulnerabilities in ATM software, trigger unauthorised cash dispensing, and then clean up after itself by wiping traces from infected machines. It also included anti-forensics features designed to slow down anyone trying to reverse-engineer it. Whoever wrote it knew what they were doing.

The US has not disclosed how Canelon Aguirre was actually caught, which is fairly standard when operational details might compromise ongoing investigations.

So far, 120 defendants have been charged in connection with the broader conspiracy. Three have already been sentenced to prison: Oddry Arnoldo Cabrera Torrealba, Carlos Javier Padron, and Juan Manuel Gouveia Aguilera.