A Venezuelan national believed to be a leader of Tren de Aragua (TdA)’s ATM jackpotting activities and the developer of the infamous Ploutus ATM malware has been arrested.
According to the US, TdA is a violent transnational criminal organization that engages in different types of trafficking, robbery, fraud, extortion, and various types of financial crimes targeting US organizations, including ATM jackpotting.
The organization is blamed for ATM jackpotting attacks across 47 states, the District of Columbia, and foreign countries.
On October 2, Anibal Alexander Canelon Aguirre, 50, also known as ‘Prometheus’ and ‘The Engineer’, who was sanctioned last week by the US Treasury, appeared in court to face charges associated with his role in TdA.
He has been on the FBI’s top 10 most wanted fugitives list since March 2026, becoming the first individual added to that list for cybercrimes.
Canelon Aguirre was indicted in the US in December 2025 along with 21 other individuals for bank burglary, fraud, and money laundering conspiracy.
The US has not shared details on how he was apprehended, but noted that he will remain detained pending trial, after entering not guilty pleas.