A Venezuelan national widely believed by law enforcement authorities to be a principal leader of the notorious Tren de Aragua (TdA) transnational criminal organization\u2019s financial operations and the primary developer of the infamous Ploutus automated teller machine malware has been successfully apprehended and brought into US custody. The arrest represents a major milestone in an extensive, multi-year international law enforcement campaign targeting high-level cybercriminal syndicates that leverage sophisticated technical tools to conduct large-scale financial fraud against institutions within the United States and abroad.<\/p>\n
According to United States law enforcement and intelligence assessments, Tren de Aragua operates as a violent and highly structured transnational criminal organization. The syndicate engages in a wide array of illicit enterprises, including human and narcotics trafficking, armed robbery, financial fraud, extortion, and various forms of complex cyber-enabled financial crimes specifically targeting organizations within the United States. Among these operations, ATM jackpotting\u2014a sophisticated form of cyber-physical bank burglary where criminals force automated teller machines to dispense physical currency on demand without legitimate customer accounts being debited\u2014has become a hallmark of the group’s financial arm. <\/p>\n
Federal authorities have directly linked the criminal network to a staggering wave of coordinated ATM jackpotting operations spanning across 47 states, the District of Columbia, and multiple foreign jurisdictions. These attacks have resulted in substantial financial losses for banking institutions and highlighted vulnerabilities in physical and digital banking infrastructure.<\/p>\n
On October 2, 50-year-old Anibal Alexander Canelon Aguirre, who is also known within criminal and investigative circles by the aliases \u201cPrometheus\u201d and \u201cThe Engineer,\u201d made his initial appearance in a United States courtroom to face formal federal charges associated with his extensive leadership role in the criminal enterprise. Canelon Aguirre was formally sanctioned just weeks prior by the United States Department of the Treasury, which targeted his illicit financial network and designated him as a primary node in the transnational syndicate’s cyber operations.<\/p>\n
The arrest follows a high-profile escalation in the international hunt for Canelon Aguirre, who had held a prominent position on the Federal Bureau of Investigation\u2019s top ten most wanted fugitives list since March 2026. Notably, his addition to that elite and heavily scrutinized list marked a historic first, as he became the very first individual to be placed among the FBI’s most wanted fugitives specifically for cybercrimes rather than traditional violent offenses, terrorism, or white-collar financial fraud of a non-technical nature.<\/p>\n
Prior to his recent court appearance, Canelon Aguirre was formally indicted in the United States in December 2025. That indictment also named 21 other alleged co-conspirators, charging them with a series of serious federal offenses including bank burglary, wire fraud, and conspiracy to commit money laundering. While United States authorities have not publicly disclosed the precise tactical details or operational mechanics of how Canelon Aguirre was ultimately located and apprehended, judicial proceedings have confirmed that he entered formal pleas of not guilty during his court appearance and will remain detained in federal custody pending the outcome of his upcoming trial.<\/p>\n
According to detailed assessments provided by United States law enforcement agencies, Canelon Aguirre served as one of the central masterminds and technical architects behind the systematic ATM jackpotting campaigns carried out by Tren de Aragua. His primary contribution to the syndicate’s criminal infrastructure was the creation and continuous refinement of Ploutus, a specialized and highly destructive malware family specifically engineered to compromise automated teller machines.<\/p>\n
Members and operational cells of the TdA criminal syndicate executed these attacks by physically accessing or remotely exploiting vulnerabilities within targeted ATMs. Once access was gained, operators deployed the Ploutus malware onto the machine’s internal computer system. The malicious software effectively overrode the standard operating logic of the ATM, forcing the hardware peripherals to dispense vast quantities of physical cash directly to the operatives without registering the transactions or debiting any valid bank accounts. <\/p>\n
To evade detection by bank security teams, law enforcement agencies, and digital forensics investigators, Ploutus was designed with advanced anti-analysis capabilities. These sophisticated evasion techniques were intended to actively hinder forensic investigations and make it exceptionally difficult for security analysts to reverse-engineer the malware or trace the origin of the attacks. Furthermore, the malware possessed built-in self-deletion routines, allowing it to systematically erase itself from compromised systems once the jackpotting operation was complete, thereby covering the tracks of the criminal operatives and destroying digital evidence before authorities could respond.<\/p>\n
The ongoing federal investigation into the Ploutus malware conspiracy has grown significantly in scope over the past several years. To date, United States federal prosecutors have formally charged a total of 120 defendants for their respective roles in the complex transnational conspiracy. As the judicial process moves forward, several key members of the organization have already faced significant legal consequences for their participation in the crimes. Three defendants have been convicted and sentenced to substantial federal prison terms: Oddry Arnoldo Cabrera Torrealba, Carlos Javier Padron, and Juan Manuel Gouveia Aguilera.<\/p>\n","protected":false},"excerpt":{"rendered":"
A Venezuelan national widely believed by law enforcement authorities to be a principal leader of…<\/p>\n","protected":false},"author":14,"featured_media":835,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[313],"tags":[907,904,900,323,910,909,905,321,320,908,896,902,899,906,901,322,903],"class_list":["post-836","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-incident-response-forensics","tag-apprehended","tag-aragua","tag-behind","tag-blockchain-analysis","tag-breakthrough","tag-cybercrime","tag-financial","tag-forensics","tag-incident-response","tag-international","tag-major","tag-malware","tag-mastermind","tag-operations","tag-ploutus","tag-tracking","tag-tren"],"_links":{"self":[{"href":"https:\/\/smartcryptosecurity.com\/index.php?rest_route=\/wp\/v2\/posts\/836","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/smartcryptosecurity.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/smartcryptosecurity.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/smartcryptosecurity.com\/index.php?rest_route=\/wp\/v2\/users\/14"}],"replies":[{"embeddable":true,"href":"https:\/\/smartcryptosecurity.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=836"}],"version-history":[{"count":0,"href":"https:\/\/smartcryptosecurity.com\/index.php?rest_route=\/wp\/v2\/posts\/836\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/smartcryptosecurity.com\/index.php?rest_route=\/wp\/v2\/media\/835"}],"wp:attachment":[{"href":"https:\/\/smartcryptosecurity.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=836"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/smartcryptosecurity.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=836"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/smartcryptosecurity.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=836"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}