FBI Arrests ‘Most Wanted’ Developer of Ploutus ATM Malware

Anibal Alexander Canelon Aguirre, a Venezuelan national and alleged leader of the Tren de Aragua criminal group, was arrested for his role in developing the Ploutus ATM malware used in widespread ATM jackpotting attacks. The malware exploited vulnerabilities in ATM systems to force cash dispensing without account debits. Ploutus featured anti-analysis capabilities and could erase itself from infected systems to avoid detection. The criminal organization targeted US organizations across 47 states and internationally. Canelon Aguirre was indicted along with 21 others in December 2025 and was the first cybercriminal added to the FBI's top 10 most wanted list. The US Treasury sanctioned him prior to his arrest. The operation has led to charges against 120 defendants, with several already sentenced.

The Ploutus malware enabled attackers to dispense cash from ATMs without debiting accounts, resulting in significant financial losses across numerous US states and other countries. The malware's anti-forensic features complicated incident response and forensic investigations. The criminal activities involved bank burglary, fraud, and money laundering conspiracies, impacting financial institutions and their customers. The arrest of the developer and other defendants disrupts the criminal network responsible for these attacks.

No specific patch or remediation applies as this is a criminal operation involving malware deployment on ATM systems. Law enforcement actions, including arrests and prosecutions, are the primary mitigation. Financial institutions should continue to monitor for ATM jackpotting activity and apply security controls recommended for ATM infrastructure, but no direct technical remediation for Ploutus malware is described in this report.