US announces arrest of Ploutus developer

The Justice Department said Anibal Alexander Canelon Aguirre had been arrested as the alleged developer of Ploutus. It said he was also known as Prometheus and The Engineer, and the FBI had previously placed him on its Most Wanted list.

According to court documents, Canelon Aguirre and accomplices used the malware in ATM jackpotting attacks between February 2024 and December 2025. The filing said losses were more than $100,000 per incident and that more than $5.4 million had been taken in attacks on banks and credit unions.

The Justice Department said the stolen money was laundered and moved to accounts controlled by Tren de Aragua in several countries. In its press release, it said the malware included measures intended to obstruct analysis and files meant to remove it from infected machines.

Canelon Aguirre was charged in Nebraska in December 2025 with conspiracy to commit bank fraud, conspiracy to commit money laundering, conspiracy to commit bank burglary and fraud involving computers, and conspiracy to provide material support to terrorists. The Treasury Department designated TdA in July 2024, the State Department designated it in February 2025, and OFAC sanctioned eight TdA members last week.

The Justice Department said it had charged 98 suspects in TdA-linked ATM jackpotting cases since October 2025. It also said the FBI warned in February that more than $20 million had been stolen in 2025 in a surge of ATM hacking attacks.