A Venezuelan citizen, allegedly a central figure in the ATM jackpotting operations of the Tren de Aragua (TdA) and the creator of the notorious Ploutus ATM malware, has been apprehended by the FBI.
Background on Tren de Aragua’s Activities
The United States identifies TdA as a violent international criminal group involved in various illicit activities such as trafficking, robbery, and fraud. Among their many financial crimes, ATM jackpotting stands out, affecting numerous organizations across the US, including 47 states and the District of Columbia, as well as international territories.
Details of the Arrest
Anibal Alexander Canelon Aguirre, 50, known by aliases ‘Prometheus’ and ‘The Engineer’, was arrested following recent sanctions by the US Treasury. On October 2, he faced court charges related to his involvement with TdA. Canelon Aguirre has been on the FBI’s top ten most wanted list since March 2026, becoming the first to be included for cybercrimes.
Although the US authorities have not disclosed the specifics of his capture, Canelon Aguirre has pleaded not guilty and will remain in custody until trial. He was earlier indicted in December 2025 alongside 21 others, facing charges of bank burglary, fraud, and money laundering conspiracy.
Impact of Ploutus Malware
Canelon Aguirre is purported to be a leading figure in exploiting ATM system weaknesses to deploy Ploutus malware. This software enables ATMs to dispense cash without account debits, featuring advanced anti-analysis capabilities to evade forensic scrutiny and self-erasure to conceal its presence.
To date, 120 individuals face charges in connection with these activities, with three already serving prison sentences: Oddry Arnoldo Cabrera Torrealba, Carlos Javier Padron, and Juan Manuel Gouveia Aguilera.
Future Outlook
The arrest of Canelon Aguirre marks a significant step in tackling global cybercrime networks. As investigations continue, authorities aim to dismantle such operations, enhancing security measures to prevent future attacks. This case underscores the importance of international cooperation in fighting cyber threats.
