The FBI’s First Cybercriminal on Its Top 10 Most Wanted List Is in Custody Over ATM Jackpotting Malware
The Justice Department says the alleged developer of Ploutus, malware used to make ATMs spit out cash across the U.S., has been arrested. Here is a briefing on the case and the scheme behind it.
The Justice Department has announced the arrest of the man it says built Ploutus, malware that forces ATMs to dispense cash without touching anyone’s account. The case connects a cybercrime tool to a violent transnational gang, and it shows how physical access to a machine can become a digital attack. Here is the briefing.
Who was arrested
Anibal Alexander Canelon Aguirre, 50, also known as “Prometheus” and “The Engineer.” In March 2026 he became the first cybercriminal ever placed on the FBI’s Top 10 Most Wanted Fugitives list. The Justice Department announced his arrest in a press release on Friday.
What prosecutors allege
- Court documents say he and accomplices used Ploutus to empty ATMs at banks and credit unions between February 2024 and December 2025.
- Losses topped $100,000 per incident. Prosecutors count at least 63 jackpotting attacks on banks and 54 on credit unions, with more than $5.4 million stolen and another $1,429,738 in attempted thefts.
- The money was laundered and moved to accounts controlled by the Venezuelan gang Tren de Aragua (TdA) in several countries.
- The Justice Department calls him the developer of Ploutus and one of the principal leaders of the jackpotting conspiracy.
How the malware was built to hide
According to the Justice Department, Ploutus included anti-analysis protections meant to block reverse-engineering and debugging, plus files that deleted the malware from the ATM. The goal was to keep bank and credit union staff from realizing the machine had been tampered with.
The charges
- Conspiracy to commit bank fraud, up to 30 years in prison
- Conspiracy to commit money laundering, up to 20 years
- Conspiracy to commit bank burglary and computer fraud, up to five years
- Conspiracy to provide material support to terrorists, up to 15 years
He was charged in Nebraska in December 2025.
The bigger picture
- The Treasury Department designated TdA a transnational criminal organization in July 2024, and the State Department named it a foreign terrorist organization in February 2025.
- Last week, the Treasury’s Office of Foreign Assets Control sanctioned eight TdA members over jackpotting attacks on U.S. financial institutions, Canelon Aguirre among them.
- Investigators say the conspiracy targeted or carried out jackpotting attacks in 47 states, the District of Columbia and several other countries.
- Since October 2025, the Justice Department has charged 98 people in TdA-linked jackpotting schemes.
- In February, the FBI warned that criminals stole more than $20 million through ATM attacks in 2025.
Read Sergiu Gatlan’s full report at BleepingComputer for the Justice Department’s statements and background on the case.
What this means for your company
- Physical access is a cyber risk. Kiosks, point-of-sale terminals and other unattended devices can be compromised by someone with a few minutes and a cable. Lock enclosures and check them regularly.
- Clean-looking systems can still be compromised. Malware designed to erase itself leaves little behind. Keep logs off the device and watch for unexplained transactions or restarts.
- Credit unions and community banks are squarely in scope. Smaller institutions were hit dozens of times in this scheme. Share alerts with peers and your ATM service provider.
Need help securing the kiosks, terminals and other unattended devices your business depends on? Reach out to Layer 7 Data Solutions to discuss how we’ve helped companies similar to yours.
About The Author
