A Venezuelan national widely believed by law enforcement authorities to be a primary leader of the Tren de Aragua (TdA) criminal syndicate\u2019s ATM jackpotting operations, as well as the principal developer of the infamous Ploutus ATM malware, has been successfully apprehended and brought before a court to face a battery of serious federal charges. The high-profile arrest marks a major milestone in an extensive, multi-year international law enforcement campaign targeting the financial cybercrime infrastructure of one of the world’s most violent transnational criminal organizations.<\/p>\n
According to statements and legal filings from United States authorities, Tren de Aragua operates as a ruthless transnational criminal organization engaged in a broad spectrum of illicit enterprises, including various forms of trafficking, armed robbery, financial fraud, extortion, and sophisticated financial crimes specifically targeting organizations within the United States. Among these criminal endeavors, ATM jackpotting has emerged as one of the syndicate’s most lucrative and disruptive activities, impacting financial institutions, convenience stores, and banking networks across an astonishing geographical footprint. <\/p>\n
Federal investigators have directly blamed the organization and its cyber-operations wing for a coordinated wave of ATM jackpotting attacks spanning 47 states, the District of Columbia, and multiple foreign jurisdictions. These attacks have systematically undermined the physical and digital security of cash-dispensing machines, causing significant financial losses for banking institutions and posing major security challenges for law enforcement agencies tasked with protecting public infrastructure.<\/p>\n
On October 2, 50-year-old Anibal Alexander Canelon Aguirre appeared in a United States courtroom to formally face a series of criminal charges directly associated with his critical leadership role in the Tren de Aragua syndicate. Operating under the notorious aliases "Prometheus" and "The Engineer," Canelon Aguirre had already drawn intense international scrutiny prior to his court appearance. Just one week before his court date, he was officially placed on sanctions lists by the United States Treasury Department, which targeted him as a central figure in the global distribution and deployment of advanced ATM malware.<\/p>\n
The gravity of Canelon Aguirre\u2019s alleged cybercrimes is further underscored by his history with United States federal law enforcement. He has held a position on the Federal Bureau of Investigation\u2019s (FBI) top 10 most wanted fugitives list since March 2026, a distinction that makes him a historical figure in the annals of American law enforcement as the very first individual to be added to that elite and heavily scrutinized list specifically for cybercrimes. <\/p>\n
Legal proceedings against Canelon Aguirre have been moving steadily through the American judicial system. He was initially indicted in the United States in December 2025 alongside 21 other co-defendants. That sweeping indictment laid out a web of criminal activity, charging the accused individuals with bank burglary, wire fraud, and conspiracy to commit money laundering. While United States authorities have not yet publicly shared specific operational details regarding how Canelon Aguirre was ultimately located, apprehended, and brought into custody, judicial officials have confirmed that he entered formal pleas of not guilty during his court appearance and will remain securely detained pending trial due to the severe flight risk and danger to the community he represents.<\/p>\n
According to comprehensive findings presented by United States investigators, Canelon Aguirre served as one of the primary masterminds and technical architects behind the devastating ATM jackpotting attacks carried out by Tren de Aragua operatives utilizing the Ploutus malware family. The mechanics of these attacks relied heavily on specialized technical expertise and physical access to targeted machines. Members of the criminal operation systematically exploited physical and logical vulnerabilities in automated teller machines to install and deploy the malware. Once activated, Ploutus allowed the perpetrators to override standard banking protocols, forcing the infected systems to dispense physical cash on demand without debiting funds from any valid customer accounts or leaving the usual transaction logs that banks rely on for accounting reconciliation.<\/p>\n
The Ploutus malware itself was engineered with sophisticated evasion tactics designed to frustrate law enforcement and digital forensics investigators. The malicious software contained advanced anti-analysis capabilities specifically intended to hinder forensic examination by security researchers and digital detectives. Furthermore, Ploutus was designed with self-erasing functionalities, allowing it to systematically wipe its own code and associated artifacts from infected ATM systems once the cash-out operations were complete, thereby hiding the perpetrators’ tracks and making post-incident investigations exceptionally difficult.<\/p>\n
The apprehension and prosecution of Canelon Aguirre represent a critical advancement in a much broader, coordinated federal crackdown on the Tren de Aragua financial conspiracy. To date, United States authorities have charged a staggering total of 120 defendants for their respective roles in the expansive criminal enterprise. The judicial system has already begun delivering significant accountability for these offenses. Three key defendants implicated in the conspiracy have already been convicted and sentenced to substantial federal prison terms: Oddry Arnoldo Cabrera Torrealba, Carlos Javier Padron, and Juan Manuel Gouveia Aguilera. As the legal process continues to unfold for Canelon Aguirre and his remaining co-defendants, federal prosecutors and investigative agencies remain focused on dismantling the remaining financial and operational networks that sustain the global criminal activities of Tren de Aragua.<\/p>\n","protected":false},"excerpt":{"rendered":"
A Venezuelan national widely believed by law enforcement authorities to be a primary leader of the Tren de Aragua (TdA) criminal syndicate\u2019s ATM jackpotting operations, as well as the principal developer of the infamous Ploutus ATM malware, has been successfully apprehended and brought before a court to face a battery of serious federal charges. The<\/p>\n","protected":false},"author":7,"featured_media":812,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[313],"tags":[889,395,884,323,892,75,890,321,320,885,887,883,891,886,322,888],"class_list":["post-813","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-incident-response-forensics","tag-aragua","tag-arrested","tag-behind","tag-blockchain-analysis","tag-charges","tag-faces","tag-financial","tag-forensics","tag-incident-response","tag-infamous","tag-malware","tag-mastermind","tag-operations","tag-ploutus","tag-tracking","tag-tren"],"_links":{"self":[{"href":"https:\/\/wyominginvest.com\/index.php?rest_route=\/wp\/v2\/posts\/813","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/wyominginvest.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/wyominginvest.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/wyominginvest.com\/index.php?rest_route=\/wp\/v2\/users\/7"}],"replies":[{"embeddable":true,"href":"https:\/\/wyominginvest.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=813"}],"version-history":[{"count":0,"href":"https:\/\/wyominginvest.com\/index.php?rest_route=\/wp\/v2\/posts\/813\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/wyominginvest.com\/index.php?rest_route=\/wp\/v2\/media\/812"}],"wp:attachment":[{"href":"https:\/\/wyominginvest.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=813"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/wyominginvest.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=813"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/wyominginvest.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=813"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}