FBI Most-Wanted ATM Malware Developer Arrested
The alleged developer of Ploutus, malware used to make ATMs dispense their entire cash supply, has appeared in a U.S. court following his arrest — the first cybercriminal ever added to the FBI's Ten Most Wanted Fugitives list.
Key facts
Who: Anibal Alexander Canelon Aguirre, 50, also known as "Prometheus" and "The Engineer"
The distinction: First cybercriminal added to the FBI's Top 10 Most Wanted Fugitives list, in March 2026
The thefts: More than $5.4 million stolen in at least 63 ATM jackpottings against banks and 54 against credit unions, between February 2024 and December 2025, plus $1,429,738 in attempted attacks
The scope: The conspiracy targeted or carried out attacks in 47 states, the District of Columbia and several foreign nations
The money trail: Stolen funds were laundered and transferred to accounts controlled by the Venezuelan gang Tren de Aragua
The charges: Conspiracy to commit bank fraud (30 years maximum), money laundering (20 years), bank burglary and computer fraud (5 years), and providing material support to terrorists (15 years)
What is ATM jackpotting?
Making a cash machine empty itself on command. Attackers gain physical access to an ATM's internal computer, install malware, and instruct the machine to dispense all its cash — no stolen cards, no compromised accounts.
The money comes from the bank or credit union operating the machine, not from customer accounts. Losses exceeded $100,000 per incident in this campaign.
Ploutus has been around for years in various forms. According to the Justice Department, this version contained anti-analysis measures to hinder forensic review, including software protections against reverse-engineering and debugging, plus files that deleted the malware afterward to conceal its deployment from the financial institution's staff.
Why is a terrorism charge involved?
Because of where the money went. The criminal ring laundered stolen funds and transferred them to accounts controlled by Tren de Aragua, a Venezuelan gang the U.S. Treasury designated a transnational criminal organization in July 2024 and the State Department designated a foreign terrorist organization in February 2025.
The Justice Department says TdA's activities range from drug and firearms trafficking to commercial sex trafficking, kidnapping, robbery, theft, fraud and extortion, and that the gang developed ATM jackpotting as an additional revenue stream targeting U.S. financial institutions.
How big is the crackdown?
Substantial and ongoing. Since October 2025, the Justice Department has charged 98 suspects in ATM jackpotting schemes linked to TdA, facing maximum sentences from 20 to 335 years each.
Last week, the Office of Foreign Assets Control sanctioned eight TdA members, including Canelon Aguirre, for their roles in attacks on U.S. financial institutions.
The scale behind the enforcement: the FBI warned in February that criminals stole more than $20 million through ATM hacking in 2025.
What this means for consumers and businesses
For individual bank customers, essentially nothing — jackpotting steals the institution's cash, not yours, and does not compromise accounts or cards.
The broader point is about organized crime's shift into cyber-enabled theft. A gang known for violent crime built a technical capability, deployed it across 47 states, and ran it for nearly two years. That trajectory — traditional criminal organizations adding cyber revenue streams — is what the enforcement push is responding to.