Anibal Alexander Canelon Aguirre arrested for ATM malware development

Anibal Alexander Canelon Aguirre, a Venezuelan national known as ‘Prometheus’ or ‘The Engineer’, has been arrested for his alleged role as a mastermind behind ATM jackpotting attacks. Canelon Aguirre is believed to be a leader within the transnational criminal organization Tren de Aragua (TdA) and the developer of the Ploutus ATM malware.

The Ploutus malware allowed attackers to exploit ATM vulnerabilities to force cash dispensing without debiting accounts. The software included anti-analysis and self-erasing capabilities to evade forensic detection. TdA is linked to ATM jackpotting activities across 47 U.S. states, the District of Columbia, and several foreign countries.

Canelon Aguirre, who was previously on the FBI’s top 10 most wanted fugitives list, appeared in a Nebraska court and pleaded not guilty to charges including bank burglary, fraud, and money laundering conspiracy. He was denied bail and will remain detained pending trial, which a judge described as a complex prosecution. His apprehension involved assistance from the U.S. Coast Guard and the FBI’s Critical Incident Response Group.