Robotics

Alleged Developer of Ploutus ATM Malware Appears in Court

The U.S. Department of Justice announced the arrest and court appearance of the alleged developer behind the Ploutus ATM malware, tied to millions of dollars in losses across the United States.

Radwan AbdulhadiEditor and technology writer

Published: October 6, 2026 · Updated: October 6, 2026 · 3 min read

Alleged Developer of Ploutus ATM Malware Appears in Court — Image: BleepingComputer

Court Appearance of the Alleged Developer

The U.S. Department of Justice has announced the arrest and subsequent court appearance of the alleged developer behind the Ploutus ATM malware, a tool utilized to steal millions of dollars in jackpotting attacks across the United States. According to court documents, the individual was brought before a court following a high-profile apprehension.

The suspect, 50-year-old Anibal Alexander Canelon Aguirre, is also known by the aliases "Prometheus" and "The Engineer." He was notably added to the FBI's "Top 10 Most Wanted Fugitives" list in March 2026.

Canelon Aguirre FBI wanted poster (FBI) · Source: BleepingComputer

Mechanics of the Ploutus Malware Operations

Investigators detailed how Canelon Aguirre and his accomplices deployed the Ploutus malware to empty bank and credit union automated teller machines during a sustained wave of jackpotting attacks between February 2024 and December 2025. Financial losses from these incidents routinely surpassed $100,000 per occurrence.

During operations, the criminal ring successfully targeted banks and credit unions across numerous states and foreign nations. The Justice Department emphasized the sophistication of the tool, noting its integration of anti-analysis measures to hinder forensic examination, along with built-in routines to delete itself and deceive financial institution employees.

Financial Impact and Gang Affiliation

Data released regarding the campaign highlights over $5.4 million stolen across at least 63 ATM jackpottings targeting banks, alongside 54 attacks against credit unions and an additional $1.4 million in attempted actions. Stolen funds were laundered and subsequently funneled into accounts managed by the Tren de Aragua (TdA) Venezuelan gang.

Following a wave of arrests targeting individuals connected to the criminal organization, authorities noted the broader scope of financial crimes. The FBI also warned in February regarding the massive financial toll taken by these continuous attacks throughout the previous year.

Suspects installing malware in ATM jackpotting attacks (Treasury Department) · Source: BleepingComputer

Broader Enforcement Actions and Charges

Canelon Aguirre faces multiple serious charges filed in Nebraska in December 2025, including conspiracy to commit bank fraud, money laundering, bank burglary, and providing material support to terrorists. These charges carry significant potential prison sentences if convicted.

执法 agencies continue to pursue associates linked to the TdA network as part of a broader crackdown on transnational financial crimes affecting institutions across the United States, the District of Columbia, and multiple foreign territories.