Alleged Malware Creator Appears in Court After Arrest
Anibal Alexander Canelon Aguirre, a 50-year-old Venezuelan national known by aliases "Prometheus" and "The Engineer," appeared in a Nebraska district court on Friday following his arrest by federal authorities. Aguirre pleaded not guilty to multiple charges related to his alleged role as the mastermind behind the Ploutus malware, a sophisticated tool used to drain cash from ATMs across the United States and Latin America.
Charges and Legal Proceedings
Aguirre was indicted by a federal grand jury in Nebraska last December on charges including conspiracy to commit bank fraud, conspiracy to commit bank burglary, fraud in connection with computers, money laundering, and providing material support to terrorists. If convicted, he faces a maximum sentence of 70 years in prison. He will remain in federal detention pending trial.
Ploutus Malware and ATM Jackpotting Scheme
The Justice Department has identified Aguirre as the key architect of Ploutus malware, which criminals use to compromise ATMs by physically accessing the machine, connecting a personal device, and installing the malware to forcibly dispense cash. This method, known as ATM jackpotting, has been linked to losses exceeding $40.7 million from approximately 1,500 attacks tracked by U.S. officials since 2013.
Cybersecurity experts note that while Ploutus is one of the most advanced ATM-focused malware strains, they have not been able to independently verify Aguirre’s role as its original developer. Variants of the malware have been used in attacks across Latin America and the United States for over a decade.
Connection to Transnational Criminal Organization
Assistant Attorney General A. Tysen Duva stated that Aguirre served as a key architect of malware that helped fuel the operations of Tren de Aragua (TdA), a violent transnational criminal organization based in Venezuela. U.S. officials have alleged that proceeds from ATM jackpotting attacks were funneled to Tren de Aragua members through cryptocurrency or by laundering funds via companies they own in Mexico and other countries.
The Justice Department maintains there are "extensive direct and indirect links" between the Ploutus malware used in the jackpotting scheme and Tren de Aragua, which has been designated as a significant threat by U.S. authorities.
Recent Attacks and Financial Impact
Between February 2024 and December 2025, Aguirre and his associates conducted 117 ATM jackpotting attacks on banks and credit unions, primarily targeting machines in remote locations across states including Nebraska. The group earned more than $5.4 million from these attacks during that period.
Aguirre typically coordinated operations by directing others to physically access ATMs and install the malware remotely, after which on-site participants retained a portion of the proceeds before transferring the remainder to senior figures in the organization.
Arrest and Return to the United States
Aguirre was added to the FBI’s "Top 10 Most Wanted Fugitives" list in March, marking the first time a cybercriminal was included on the roster. While Fox News reported he was arrested in Venezuela last month, Justice Department officials declined to confirm the location or method of his detention, stating it would be "inaccurate" to describe his return as an extradition.
FBI Director Kash Patel affirmed that Aguirre is "back in the United States to face justice," though a DOJ spokesperson clarified that he was not in the United States prior to his return and was not extradited, without elaborating on the legal mechanism used for his transfer.
Broader Enforcement Actions
Last week, the Treasury Department sanctioned Aguirre and several others for allegedly using businesses and other tools to launder proceeds from the ATM jackpotting scheme. To date, approximately 120 individuals have been charged in connection with the broader investigation into ATM jackpotting operations linked to this malware and criminal network.
Source: The Record