Threats · 5h ago
Anibal Alexander Canelon Aguirre, whom U.S. authorities say developed the Ploutus ATM malware for Tren de Aragua, appeared in Nebraska court on Oct. 2 and pleaded not guilty. He was detained pending trial after being named in a December 2025 indictment that has now grown to 120 defendants tied to ATM jackpotting cases across 47 states, the District of Columbia, and abroad.
Ploutus attacks start when crews physically open an ATM, connect a device, and load malware that orders the machine to spit out cash without debiting any accounts. The machine can look normal from the outside while the malware runs inside, and Ploutus was built to hinder forensic analysis and erase itself from infected systems.
The arrest may help investigators connect separate jackpotting crews to one toolkit and command chain, but it does not remove the underlying ATM exposure. Any fleet that can still be opened and tampered with remains vulnerable to kiosk-level intrusion, even if the operator has no card-fraud signal to chase.
2 sources covering this story
The Record from Recorded Future
Alleged ATM malware creator appears in Nebraska court after arrest
Aguirre was added to the FBI’s “Top 10 Most Wanted Fugitives” list in March, becoming the first cybercriminal added to the list.
FBI Arrests ‘Most Wanted’ Developer of Ploutus ATM Malware
An alleged leader of Tren de Aragua’s ATM jackpotting activities, Canelon Aguirre was on the FBI’s top 10 most wanted list since March 2026.
Part of the PlainSec briefing for 2026-10-06