Security Reports disagree 3 publishers 2 min read Published Oct 5, 2026, 6:30 AM PDT Updated Oct 6, 2026, 9:22 AM PDT

US arrest removes the alleged author of Ploutus from a $5.4 million ATM jackpotting ring

US authorities arrested Anibal Alexander Canelon Aguirre, alleged developer of Ploutus ATM malware, over $5.4 million stolen in 117 jackpottings. Prosecutors say jackpotting earned money for Tren de Aragua and hit ATMs in 47 states.

The Watch · Security desk

Send a correction

What happened

He was charged in Nebraska in December 2025 with conspiracy counts covering bank fraud, money laundering, bank burglary and computer fraud, and material support to terrorists.
Prosecutors say Ploutus included files that deleted it from the ATM so the institution's employees would not learn it had been deployed.
The Justice Department has charged 98 people in Tren de Aragua-linked jackpotting schemes since October 2025.

Why it matters

What it limits constraint A bank or credit union examining an emptied machine may find the malware already gone, and any sample it does recover was built to resist debugging and reverse-engineering.
What it sets up precedent With Tren de Aragua designated a terrorist group, a jackpotting developer faces a 15-year material-support count beside the fraud charges, and other defendants in linked schemes can expect the same.
Who has to decide decision Banks and credit unions have to decide whether the arrest changes their ATM defenses. Because accomplices deployed the malware, the evidence supports keeping Ploutus in the threat model.

Next story · Security · 3d ago

Prosecutors say an OpenAI engineer left an encrypted recorder in a conference room TV's USB port

Confirmed13 publishers

The dollar figures in the case do not line up cleanly. More than $5.4 million across at least 117 jackpottings ^[7]^[17] works out to about $46,000 per attack ^[18]. The same account of the court documents puts losses above $100,000 per incident ^[22]. Both can be true only if the per-incident figure includes losses beyond the cash taken. Attempted attacks add another $1,429,738 ^[14].

The Justice Department's technical description of Ploutus is about concealment. "Ploutus malware consisted of, among other things, files that contained anti-analysis measures to hinder forensic review, specifically software protection utilities to prevent reverse-engineering and debugging," the department said in a Friday press release ^[9]. It calls Canelon Aguirre, 50, both the alleged developer and "one of the principal leaders of ATM jackpotting conspiracy" ^[3]^[2].

Sanctions and designations came before the arrest. Prosecutors say the ring laundered the cash and moved it to accounts controlled by Tren de Aragua in several countries ^[8]. Treasury designated the gang a transnational criminal organization in July 2024 ^[15], and the State Department named it a foreign terrorist organization in February 2025 ^[16]. In March 2026 the FBI made Canelon Aguirre, also known as "Prometheus" and "The Engineer," the first cybercriminal on its Top 10 Most Wanted Fugitives list ^[2]. Last week the Office of Foreign Assets Control sanctioned him and seven other Tren de Aragua members over jackpotting attacks on US financial institutions ^[5].

The FBI's count of the wider problem is larger than this case. In February it warned that criminals stole more than $20 million through ATM attacks in 2025 ^[12]. That is about 3.7 times the total charged to this conspiracy over its whole run ^[19]. Court documents describe Canelon Aguirre deploying Ploutus with accomplices ^[6]. Defendants in the linked schemes face maximum sentences of 20 to 335 years each ^[21]. For a bank or credit union, the alleged author's arrest still leaves the deployed copies unresolved: the record as reported does not say whether any were recovered, or whether any were used after December 2025.

What to watch

Any FBI or Justice Department statement on Ploutus activity after December 2025, or on copies recovered from charged defendants.
Canelon Aguirre's plea and later hearings on the Nebraska charges, including the material-support count.
Further OFAC designations of Tren de Aragua members tied to jackpotting beyond the eight named last week.

Clarity's read

What the record supports and how the coverage leans. The claims behind it follow.

Reality

Evidence70
Adoption: Not scored
Hype gap+25
Incentives60
Confidence65

Perspective Coverage

3 publishers

Builder: Builder 18%
Operator: Operator 69%
Investor: Investor 13%

Why these scores

Claim ledger

Ranked by verification strength, evidence, and original report placement.

[1]
The U.S. Department of Justice announced the arrest of the alleged developer of Ploutus malware, used to steal millions of dollars in ATM jackpotting attacks across the United States.
Reported Supported Source: BleepingComputer, citing DOJ announcementView cited source
[2]
Anibal Alexander Canelon Aguirre, 50, also known as "Prometheus" and "The Engineer," was the first cybercriminal added to the FBI's Top 10 Most Wanted Fugitives list, in March 2026.
Reported Supported Source: BleepingComputerView cited source
[3]
"Canelon Aguirre is alleged to be the developer of the Ploutus malware and one of the principal leaders of ATM jackpotting conspiracy."
Reported Supported Source: Justice Department, Friday press release, quoted by BleepingComputerView cited source
[4]
Canelon Aguirre was charged in Nebraska in December 2025 with conspiracy to commit bank fraud (maximum 30 years), conspiracy to commit money laundering (maximum 20 years), conspiracy to commit bank burglary and fraud in connection with computers (five years), and conspiracy to provide material support to terrorists (maximum 15 years).
Reported Supported Source: BleepingComputerView cited source
[5]
Last week, OFAC sanctioned eight Tren de Aragua members, including Canelon Aguirre, for their roles in jackpotting attacks targeting U.S. financial institutions.
Reported Supported Source: BleepingComputerView cited source
[6]
According to court documents, Canelon Aguirre and his accomplices deployed Ploutus malware and emptied bank and credit union ATMs in jackpotting attacks between February 2024 and December 2025.
Reported Supported Source: BleepingComputer, citing court documentsView cited source
[7]
More than $5.4 million was stolen in at least 63 ATM jackpottings targeting banks and another 54 against credit unions.
Reported Supported Source: BleepingComputer, citing court documentsView cited source
[8]
The ring's members laundered the stolen funds and transferred them to accounts controlled by the Tren de Aragua Venezuelan gang in various countries.
Reported Supported Source: BleepingComputerView cited source
[9]
"Ploutus malware consisted of, among other things, files that contained anti-analysis measures to hinder forensic review, specifically software protection utilities to prevent reverse-engineering and debugging."
Reported Supported Source: Justice Department, Friday press release, quoted by BleepingComputerView cited source
[10]
"The malware also contained other files that served the function of deleting the malware from the system in an effort to conceal, create a false impression, mislead, or otherwise deceive employees of the financial institution from learning about the deployment of the malware on the ATM."
Reported Supported Source: Justice Department press release, quoted by BleepingComputerView cited source
[11]
The Justice Department said the conspiracy targeted or carried out ATM jackpotting attacks in 47 states, the District of Columbia, and several foreign nations.
Reported Supported Source: Justice Department press release, quoted by BleepingComputerView cited source
[12]
The FBI warned in February that criminals had stolen more than $20 million in 2025 in a surge of ATM hacking attacks.
Reported Supported Source: BleepingComputer, citing FBI warningView cited source
[13]
The Justice Department said Tren de Aragua developed an additional revenue stream through financial crimes targeting U.S. financial institutions, including ATM jackpotting to steal millions of dollars in cash.
Reported Supported Source: Justice Department press release, quoted by BleepingComputerView cited source
[14]
An additional $1,429,738 was involved in attempted attacks.
Reported Supported Source: BleepingComputer, citing court documentsView cited source
[15]
The U.S. Treasury Department designated Tren de Aragua as a transnational criminal organization in July 2024.
Reported Supported Source: BleepingComputerView cited source
[16]
The Department of State designated Tren de Aragua as a foreign terrorist organization in February 2025.
Reported Supported Source: BleepingComputerView cited source
[17]
The conspiracy is charged with at least 117 jackpottings.
Derived Supported
[18]
On the stated figures, the average take is about $46,000 per jackpotting.
Derived Supported
[19]
The FBI's 2025 ATM theft figure is about 3.7 times the total charged to the Ploutus conspiracy.
Derived Supported
[20]
Since October 2025, the Justice Department has charged 98 suspects involved in ATM jackpotting schemes linked to Tren de Aragua.
Reported Contested Source: BleepingComputerView cited source
[21]
The suspects charged in Tren de Aragua-linked jackpotting schemes face maximum sentences ranging from 20 to 335 years in prison each.
Reported Contested Source: BleepingComputerView cited source
[22]
Financial losses after these attacks surpassed $100,000 per incident.
Reported Contested Source: BleepingComputer, citing court documentsView cited source

Sources

3 independent publishers whose own reporting we read for this story.

bleepingcomputer.com
1 article · October 5, 2026
Alleged dev of Ploutus ATM malware appears in US court after arrest
securityweek.com
1 article · October 6, 2026
FBI Arrests ‘Most Wanted’ Developer of Ploutus ATM Malware
therecord.media
1 article · October 6, 2026
Alleged ATM malware creator appears in Nebraska court after arrest

Clarity analysis

How the coverage leans and what the record actually supports. Read the methodology

Perspective Coverage

How much of the coverage speaks to builders, operators and investors. It measures emphasis, not whether the story is right.

Builder18%

For engineers, the useful detail is the malware design the Justice Department described: protection utilities that block reverse-engineering and debugging, plus files that delete Ploutus from the ATM after use. The Record adds the physical method. Crews open the top of the machine, connect a personal device and install the software. None of the three outlets names the ATM models or software versions that were hit.

Operator69%

Bank and credit union security teams get a measure of the threat: 117 completed jackpottings in under two years, more than $5.4 million taken, and attacks in 47 states. The Record says crews favoured ATMs in remote locations such as Nebraska. The arrest may not retire the tool. According to The Record, versions of Ploutus have hit machines across Latin America and the US since 2013, and researchers have not confirmed Canelon Aguirre wrote it.

Investor13%

The direct financial stakes are small. The charged ring's $5.4 million is spread across dozens of banks and credit unions, and The Record puts total tracked jackpotting losses at $40.7 million. The cost falls on ATM owners, particularly those running isolated machines, and the reporting includes no figures for insurance or remediation.

Reality

Evidence, adoption, hype gap, incentives and confidence, each read independently from the current record on the scale shown beneath it. How these are measured.

Evidence70: 0100
Solid on counts, thin on authorship
Every figure in the story starts with the Justice Department's filings and press release. Three outlets repeat them, and they agree on the core numbers: 117 attacks, $5.4 million, February 2024 to December 2025. The central allegation is the weak point. The Record reports that researchers who have tracked Ploutus for more than a decade cannot confirm Canelon Aguirre wrote it.
AdoptionNot scored: Criminal tooling, not a product
Ploutus is malware used by a criminal ring. The reporting counts attacks and losses, which measure harm and say nothing about adoption of a technology.
Hype gap+25: −100 understated0 aligned+100 overstated
Framing outruns verification
Calling him the author of Ploutus goes further than anyone has verified. The Record says versions of the malware have hit ATMs since 2013, and the charged conspiracy covers less than two years. BleepingComputer's statement that losses passed $100,000 per incident also conflicts with $5.4 million over 117 attacks, about $46,000 each.
Incentives60: 0100
Prosecutors gain from the Tren de Aragua link
Tying jackpotting to Tren de Aragua is what supports the material-support-to-terrorists count, because the State Department designated the gang a foreign terrorist organization in February 2025. FBI Director Kash Patel spoke of the "fugitive's return to the United States," while a DOJ spokesperson would not say how that return happened.
Confidence65: 0100
Core facts agree, totals do not
All three reports agree on the arrest, the court appearance, the not-guilty plea and the charges. Two counts disagree. BleepingComputer cites 98 Tren de Aragua-linked defendants charged since October 2025, while SecurityWeek and The Record each say 120. Loss totals also vary: the FBI's $20 million for 2025 against the $40.7 million The Record attributes to US officials, and none of the outlets explains the difference in scope.

Topics and entities

Topics

Cybercrime Law Enforcement Operations