Anibal Alexander Canelon Aguirre, whom U.S. authorities say developed the Ploutus ATM malware for Tren de Aragua, appeared in Nebraska court on Oct. 2 and pleaded not guilty. He was detained pending trial after being named in a December 2025 indictment that has now grown to 120 defendants tied to ATM jackpotting cases across 47 states, the District of Columbia, and abroad.
Ploutus attacks start when crews physically open an ATM, connect a device, and load malware that orders the machine to spit out cash without debiting any accounts. The machine can look normal from the outside while the malware runs inside, and Ploutus was built to hinder forensic analysis and erase itself from infected systems.
The arrest may help investigators connect separate jackpotting crews to one toolkit and command chain, but it does not remove the underlying ATM exposure. Any fleet that can still be opened and tampered with remains vulnerable to kiosk-level intrusion, even if the operator has no card-fraud signal to chase.