FBI Most Wanted Developer of Ploutus ATM Malware Arrested: The Engineer Is in Custody, the Playbook Is Not

Anibal Alexander Canelon Aguirre spent seven months as the only cybercriminal face on the FBI’s ten most wanted list. His court appearance on October 2 closes that chapter and opens one every African bank operator needs to think about: the man who built Ploutus is in custody, but Ploutus itself is still out there, and cash machines remain soft targets on this continent.

SecurityWeek reported this week that Aguirre, a 50-year-old Venezuelan national known in criminal forums as “Prometheus” and “The Engineer”, is believed to be a leader of Tren de Aragua’s ATM jackpotting operation and the developer of the malware that made it possible. He entered not guilty pleas and remains detained pending trial. US authorities have not said how he was apprehended.

The scale of what Ploutus powered

The US government describes Tren de Aragua as a violent transnational criminal organization into trafficking, robbery, fraud, extortion and financial crime. The ATM work is the part that concerns engineers like me. American authorities blame the group for jackpotting attacks across 47 states, the District of Columbia, and countries outside the US.

US prosecutors have cast a wide legal net. Aguirre was indicted in December 2025 alongside 21 other individuals on bank burglary, fraud and money laundering conspiracy charges. To date, 120 defendants face charges in the broader conspiracy. Three are already sentenced: Oddry Arnoldo Cabrera Torrealba, Carlos Javier Padron, and Juan Manuel Gouveia Aguilera. Aguirre was also sanctioned by the US Treasury last week, per SecurityWeek.

Why the malware design deserves your attention

Ploutus is not subtle malware. Crews exploited vulnerabilities in ATM software and hardware to get it onto machines, then triggered it to dispense cash without debiting any account. The money simply left the vault and no customer balance moved. But two design choices put it a cut above the average cash-dispenser trojan.

• Anti-analysis features. Ploutus actively hindered forensic work, buying its operators time before anyone understood what had run on the machine.
• Self-deletion. After execution it could erase itself from the infected system, so the crew walked away with cash and the ATM walked away with its memory.

That combination is the real lesson. The heist leaves the bank with a drained cassette, no malware on disk, and no clean artifact to reverse-engineer. Forensics becomes archaeology. You are reconstructing an incident from door logs and dispense counters instead of binaries.

The African angle is not hypothetical

South Africa’s banking industry has lived with ATM jackpotting for years. Criminal crews have physically drilled dispensers, injected malware through maintenance ports, and talked their way into roadside machines posing as service technicians. Any cash-handling estate that still depends on unhardened ATM operating systems, flat internal networks, and shared technician credentials has the same exposure Tren de Aragua exploited at scale across the Americas.

Here is what I would want a bank’s infrastructure team to check before the next Ploutus variant lands on this continent:

1. Whether your ATM OS builds are patched against the known cash-dispenser interface abuses, not just the headline Windows fixes.
2. Whether ATM network segments are isolated from branch back-office traffic, so a laptop plugged into one machine cannot see the rest of the estate.
3. Whether physical maintenance ports (USB, serial) are locked in hardware and monitored, because that is where crews get in.
4. Whether dispense events that do not correlate to account debits raise an alert within seconds. That mismatch is the fingerprint of jackpotting.
5. Whether technician access uses individually attributable, just-in-time credentials rather than a shared service account that has existed since 2019.

What the arrest does and does not fix

Putting “The Engineer” in a cell removes one developer and one figurehead. It does not remove the exploit knowledge. Ploutus code has circulated in criminal channels for years, and the fact that the FBI carried him on the list for seven months tells you how much demand there was for someone who could build this class of tool. Expect copycats and forks. The jackpotting playbook keeps running without its original author.

The durable win here is the 120 co-defendants and the sentences. This is the first time the US court system has treated ATM malware crews as organized bank burglary instead of quirky computer crime. That precedent matters to any bank that has ever struggled to get law enforcement to take a cash machine breach seriously.

eHawu builds network-layer protection for exactly this threat shape. When your cash endpoints, branch infrastructure and core banking traffic live on segmented, continuously verified paths, an attacker who physically reaches an ATM still cannot pivot into the estate behind it. Jackpotting needs two things: a soft machine and a flat network. eHawu takes one of them off the table.