Accused ATM Malware Developer 'Prometheus' Faces US Court After Arrest

Aníbal Alexander Canelón Agüira, a 50-year-old known by the aliases "Prometheus" and "The Engineer," has been indicted in the United States for involvement in a criminal network linked to the Venezuelan cartel Tren de Aragua. According to US authorities, he is suspected of being a primary developer of Ploutus-D, malicious software designed to compromise ATMs and force them to dispense cash without authorization or a bank card. This technique, known as jackpotting, was allegedly used by the organization to target ATMs across the Americas.

Scale of Operations and Financial Impact

The scale of the operation was substantial. US authorities report that throughout 2024 and 2025, more than $5.1 million was stolen from 117 US banks and credit unions through these attacks. The investigation focuses not only on those who operated the ATMs locally, but also on software developers, network managers, and operatives who helped launder and conceal the illicit funds.

Cryptocurrency Trails and Sanctions

The financial trail revealed a strong connection to cryptocurrency. According to the US Department of Treasury, theft proceeds were laundered through international financial networks, including digital asset transactions. On September 30, the Treasury imposed sanctions on ten entities within the suspected financial network, including seven addresses on the TRON network. Blockchain analysis firm Chainalysis found that wallets linked to this network interacted with others suspected of drug trafficking, smuggling, and other criminal enterprises.

Arrest and Legal Proceedings

In March 2026, Aníbal Alexander Agüira was added to the FBI's Ten Most Wanted Fugitives list, becoming the first cybercrime suspect to be featured. In September, he was intercepted at sea by the US Coast Guard, and on October 2, he appeared in a Nebraska court. He pleaded not guilty to charges including bank fraud conspiracy, money laundering, and providing material support to terrorism. Prosecutors allege the network stole millions to fund Tren de Aragua's operations, though the allegations have not yet been proven in court.