The FBI has captured Anibal Alexander Canelon Aguirre, a Venezuelan national and a significant player in the Tren de Aragua's illicit ATM jackpotting activities. Known by aliases such as 'Prometheus' and 'The Engineer', Canelon Aguirre is suspected of developing the notorious Ploutus ATM malware. This malware has been instrumental in a series of financial crimes across the United States and beyond, allowing perpetrators to force ATMs to dispense cash without affecting accounts. On October 2, Canelon Aguirre appeared in court to face multiple charges related to these crimes, having been placed on the FBI's top 10 most wanted fugitives list since March 2026 primarily for cybercrimes.

Tren de Aragua, identified as a violent transnational criminal organization, has been involved in various illegal activities including trafficking, robbery, and fraud, with ATM jackpotting being a significant part of their operations. Their activities have impacted 47 states, the District of Columbia, and several foreign countries. The Ploutus malware, with its anti-forensic and self-erasing capabilities, has made it challenging for authorities to trace and analyze the attacks effectively.

The US indictment against Canelon Aguirre and 21 other individuals was filed in December 2025, covering charges of bank burglary, fraud, and conspiracy to launder money. Although specifics about his arrest remain undisclosed, the FBI has ensured his detention until trial following his not guilty plea. To date, 120 individuals have been charged in connection with these crimes, with some already serving prison sentences. This arrest marks a significant victory in the fight against cybercrime, particularly ATM jackpotting.