[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fx8LRdViXTW5OuDoTXmVelVvve40sGJyj3LNTVI11K1s":3},{"article":4,"iocs":54},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"full_text":11,"url":12,"image_url":13,"published_at":14,"ingested_at":15,"relevance_score":16,"entities":17,"category_id":31,"category":32,"article_tags":36},"1298774c-6133-45b8-bddb-f50887469b9a","FBI Arrests ‘Most Wanted’ Developer of Ploutus ATM Malware","fbi-arrests-most-wanted-developer-of-ploutus-atm-malware-f07144","An alleged leader of Tren de Aragua’s ATM jackpotting activities, Canelon Aguirre was on the FBI’s top 10 most wanted list since March 2026. The post FBI Arrests ‘Most Wanted’ Developer of Ploutus ATM Malware appeared first on SecurityWeek.","Anibal Alexander Canelon Aguirre, a Venezuelan national accused of leading Tren de Aragua's ATM jackpotting operations and developing the Ploutus malware, has been arrested. He was on the FBI's top 10 most wanted list for cybercrimes. The malware allowed attackers to force ATMs to dispense cash without debiting accounts and included anti-analysis features.","FBI arrests alleged ATM malware developer and Tren de Aragua leader.","A Venezuelan national believed to be a leader of Tren de Aragua (TdA)’s ATM jackpotting activities and the developer of the infamous Ploutus ATM malware has been arrested. According to the US, TdA is a violent transnational criminal organization that engages in different types of trafficking, robbery, fraud, extortion, and various types of financial crimes targeting US organizations, including ATM jackpotting. The organization is blamed for ATM jackpotting attacks across 47 states, the District of Columbia, and foreign countries. On October 2, Anibal Alexander Canelon Aguirre, 50, also known as ‘Prometheus’ and ‘The Engineer’, who was sanctioned last week by the US Treasury, appeared in court to face charges associated with his role in TdA. He has been on the FBI’s top 10 most wanted fugitives list since March 2026, becoming the first individual added to that list for cybercrimes. Canelon Aguirre was indicted in the US in December 2025 along with 21 other individuals for bank burglary, fraud, and money laundering conspiracy.Advertisement. Scroll to continue reading. The US has not shared details on how he was apprehended, but noted that he will remain detained pending trial, after entering not guilty pleas. According to the US, Canelon Aguirre is one of the masterminds behind the ATM jackpotting attacks carried out by TdA using Ploutus. Members of the operation exploited vulnerabilities in ATMs to deploy the malware, which allowed them to force the systems to dispense cash without debiting accounts. Ploutus contained anti-analysis capabilities to hinder forensic analysis and could also erase itself from the infected systems to hide its tracks. To date, 120 defendants have been charged for their roles in the conspiracy, and three of them have been sentenced to prison: Oddry Arnoldo Cabrera Torrealba, Carlos Javier Padron, and Juan Manuel Gouveia Aguilera. Related: Alleged ShinyHunters Leader Arrested in Jordan Related: In Rare Move, Alleged Iranian State Hacker Extradited to US Related: Police Shut Down KillSec Ransomware, Identify Alleged Teen Leader Related: Prison Sentence for Former US Soldier Who Hacked AT&T and Verizon Written By Ionut Arghire Ionut Arghire is an international correspondent for SecurityWeek. Daily Briefing Newsletter Subscribe to the SecurityWeek Email Briefing for the latest cybersecurity threats, trends, and expert insights. More from Ionut Arghire Exploitation Hits Rejetto HFS Vulnerability Discovered by AI Alleged ShinyHunters Leader Arrested in JordanFortra Patches Critical Vulnerabilities in BoKSIn Rare Move, Alleged Iranian State Hacker Extradited to USWarlock Expands SharePoint Exploitation in Critical Infrastructure AttacksExploited Fortinet FortiMail Zero-Day Calls for Urgent ActionZimbra Vulnerability Exploited in the Wild Prior to Public DisclosureZammad Zero-Days Exploited in AI-Powered DIVD Hack Latest News Apple to Tighten Full Disk Access Controls in macOS Amid AI RisksCybersecurity M&A Roundup: 39 Deals Announced in September 2026Long-Running NPM Malware Campaign Accumulates 40,000 Downloads8.8 Million Impacted by Data Breach at Denmark’s Central Person RegisterSocial Engineering Detection Moves Into the Live ConversationGoogle Narrows Open Source Bug Bounty Amid Wave of Invalid Automated ReportsLinux Backdoor Abuses STUN Protocol, Exploits Dozens of Flaws250,000 Impacted by Data Breaches at New Jersey, Texas Healthcare Firms Trending Daily Briefing NewsletterSubscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts. Webinar: Securing AI Agents, MCPs, and AI Automations October 7, 2026 Learn how to address potential risks and not restrict AI adoption in your organization. See what a centralized AI gateway is and how it works in practice. Register Virtual Event: Zero Trust & Identity Strategies Summit 2026 October 14, 2026 Join as we decipher the world of zero trust and share war stories on securing an organization by eliminating implicit trust and continuously validating every stage of a digital interaction. Register People on the MoveChip Wentz has been appointed as SVP & CISO at Keurig Dr Pepper Inc.Lumen Technologies has named Kim Keever as CSO.Quantum Secure Encryption Corp. has appointed Joseph Hall as CIO.More People On The MoveExpert Insights AI Has Changed Attack Speed, Not Security Fundamentals As AI accelerates vulnerability discovery and exploitation, so-called virtual patching still comes down to defense-in-depth and strong application security fundamentals. (Joshua Goldfarb) Four Cyber Threats Harboring Big Plans for the Future - AI, supply-chain exposure, quantum computing and geopolitical conflict are testing security programs. Preparing for disruption must become part of day-to-day operations. (Steve Durbin) Begin at the End: How to Enable Agentic Remediation Agentic remediation is not an act of faith. We are talking about fixing known problems, not judgment calls about unfamiliar risk. (Nadir Izrael) “We Think the Security Control Is Working” Is No Longer Good Enough Point-in-time audits and sampled assessments offer only snapshots; continuous control monitoring provides evidence that security controls are working today. (Sravish Sridhar) This Key Will Self-Destruct: An Open Standard for Revocable API Keys Every leaked credential should be dead, or dying, within sixty seconds of being found. Here's a proposal to make that the default. (Matt Honea) Flipboard Reddit Whatsapp Whatsapp Email","https:\u002F\u002Fwww.securityweek.com\u002Ffbi-arrests-most-wanted-developer-of-ploutus-atm-malware\u002F","https:\u002F\u002Fwww.securityweek.com\u002Fwp-content\u002Fuploads\u002F2024\u002F03\u002Fhacker-sentenced-prison.jpeg","2026-10-06T12:47:57+00:00","2026-10-06T14:00:28.85891+00:00",8,[18,21,24,26,28],{"name":19,"type":20},"Tren de Aragua","threat_actor",{"name":22,"type":23},"ATM","product",{"name":25,"type":20},"Prometheus",{"name":27,"type":20},"The Engineer",{"name":29,"type":30},"FBI","vendor","6cbdd207-aaa1-4176-9534-e156b125e917",{"id":31,"icon":33,"name":34,"slug":35},null,"Nation-state","nation-state",[37,39,44,49],{"category":38},{"id":31,"icon":33,"name":34,"slug":35},{"category":40},{"id":41,"icon":33,"name":42,"slug":43},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":45},{"id":46,"icon":33,"name":47,"slug":48},"c5eccf7c-abbc-4bd3-bbed-e6da5cba8e73","Incident Response","incident-response",{"category":50},{"id":51,"icon":33,"name":52,"slug":53},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[55,58,62,65],{"type":43,"value":56,"context":57},"Ploutus","ATM jackpotting malware developed by the arrested individual.",{"type":59,"value":60,"context":61},"mitre_attack","T1059.003","Command and Scripting Interpreter: Windows Command Shell - Implied by ATM malware functionality",{"type":59,"value":63,"context":64},"T1566.001","Phishing: Spearphishing Attachment - Potential initial access vector for malware deployment",{"type":59,"value":66,"context":67},"T1070.004","Indicator Removal: File Deletion - Ploutus malware could erase itself"]