The US Justice Department said it has arrested Anibal Alexander Canelon Aguirre, 50, of Venezuela. It calls him the alleged developer of Ploutus ATM malware and a principal leader of a jackpotting plot. Jackpotting means using malware to make a cash machine pay out without debiting any account. He first appeared in court in Nebraska on Oct. 2 and pleaded not guilty, the department said. He stays in custody. A grand jury indicted him in December 2025.
The Justice Department did not say where or when he was arrested, and no trial date is given. It ties the plot to the Tren de Aragua gang. It says the conspiracy targeted or carried out attacks in 47 states, plus DC and several foreign countries. BleepingComputer, citing court documents, reported that attacks ran from February 2024 to December 2025, with more than $5.4 million stolen in at least 63 bank attacks and 54 on credit unions. An indictment is only an allegation.
The Justice Department says Ploutus was designed with files to hinder forensic review and files to delete the malware, so bank staff would not learn of it. Neither source says how well this worked. Banks and credit unions may want to ask whether they could spot an attack without leftover files, and whether they match ATM cash payouts against account debits.