Alleged Ploutus developer appears in US court after arrest

Anibal Alexander Canelon Aguirre, whom U.S. authorities allege developed the Ploutus ATM malware, appeared in court after his arrest, the U.S. Department of Justice announced. The malware was used in ATM jackpotting attacks across the United States.

Court documents say Canelon Aguirre and accomplices deployed Ploutus from February 2024 to December 2025, targeting banks and credit unions. The attacks stole more than $5.4 million in at least 63 incidents at banks and another 54 at credit unions. A further $1,429,738 was linked to attempted attacks. Losses exceeded $100,000 per incident, according to the source.

Authorities allege the group laundered the stolen money and transferred it to accounts controlled by the Venezuelan gang Tren de Aragua (TdA). The Justice Department says Ploutus included anti-analysis measures and files designed to remove the malware and conceal its deployment.

Canelon Aguirre was charged in Nebraska in December 2025 with conspiracy to commit bank fraud, money laundering, bank burglary and computer fraud, and providing material support to terrorists. The Justice Department said the alleged conspiracy targeted or carried out ATM jackpotting attacks in 47 states, the District of Columbia and several foreign countries. Since October 2025, the department has charged 98 suspects in ATM jackpotting schemes linked to TdA.