A Venezuelan national, Anibal Alexander Canelon Aguirre, pleaded not guilty in Nebraska federal court to charges that he created Ploutus malware used to steal millions from ATMs nationwide. Arrested after his placement on the FBI's Ten Most Wanted list, he is accused of leading an extensive ATM "jackpotting" operation tied to the gang Tren de Aragua. Authorities say the malware had anti-forensic features and could self-delete; 120 people have been charged so far and the investigation spans 47 states and several countries.
FBI Top 10 Fugitive — Accused ATM Malware Creator Pleads Not Guilty in Nebraska
A Venezuelan man accused of creating malware used to steal millions of dollars from ATMs across the United States pleaded not guilty in federal court. File Photo by Mike Theiler/UPI
A Venezuelan national accused of developing malware that prosecutors say siphoned millions from U.S. ATMs pleaded not guilty Friday in federal court in Nebraska.
Anibal Alexander Canelon Aguirre, 50, who has used the aliases "Prometheus" and "The Engineer," was arrested after being added to the FBI's Ten Most Wanted Fugitives list in March. He was the first person described as a cybercriminal to be placed on that list and the 540th individual added overall.
Alleged Scheme and Malware
Federal prosecutors allege Canelon Aguirre led a wide-ranging ATM "jackpotting" operation tied to the Venezuelan criminal group Tren de Aragua. In jackpotting attacks, criminals install or activate malware on cash machines to force them to dispense cash without debiting customer accounts.
Prosecutors say Canelon Aguirre developed a strain of malware known as Ploutus that was used in many of the incidents. According to court filings, the software included anti-forensic protections to hinder investigators and had the capability to erase itself from an ATM to remove traces of the intrusion.
Scope, Charges and Links to Organized Crime
The Justice Department says the alleged operation targeted or carried out attacks in 47 states, Washington, D.C., and multiple foreign countries. So far, authorities have charged 120 people in Nebraska in connection with the scheme.
Federal investigators have linked the network to Tren de Aragua, which the Trump administration designated a foreign terrorist organization. Prosecutors say the gang used ATM jackpotting as an additional revenue stream alongside crimes such as drug and firearms trafficking, kidnapping, robbery and extortion.
Indictment and Potential Penalties
Canelon Aguirre was indicted in December on counts that include conspiracy to commit bank fraud, bank burglary and computer fraud, money laundering, and providing material support to terrorists. The bank fraud count carries a maximum sentence of 30 years in prison. He remains in federal custody while awaiting trial.
Note: All allegations are from court filings and statements by prosecutors; defendants are presumed innocent until proven guilty in court.
Help us improve.
