Venezuelan Cartel’s Malware Expert Brought Down for ATM Heists
In a significant blow to transnational cybercrime, US authorities have arrested and arraigned Anibal Alexander Canelon Aguirre, a 50-year-old Venezuelan member of the notorious Tren de Aragua (TdA) cartel. Canelon Aguirre is accused of masterminding a sophisticated “jackpotting” scheme that compromised ATMs with malware, causing them to dispense tens of thousands of dollars in cash. The stolen funds were then laundered through various cryptocurrency networks, including TRON.
Tren de Aragua, a cartel involved in drug trafficking, kidnapping, and human trafficking among other crimes, has evolved into a multinational operation based primarily in Venezuela and Mexico. Cybercrime is increasingly becoming an integral part of their business model as it allows them to amass capital quietly and fund other nefarious activities. According to Ari Redbord, global head of policy at TRM Labs, “Tren de Aragua is using ATM malware as a terrorist financing tool, then moving the cash onto TRON so it looks like ordinary exchange deposits.” This modus operandi is eerily similar to that employed by foreign terrorist organizations (FTOs).
Canelon Aguirre, also known as “Prometheus” and “The Engineer,” was the principal architect of the Ploutus-D malware used in the scheme. Over two years, TdA targeted cash machines in Latin and North America, with more than $5.1 million stolen from 117 banks and credit unions in the United States in 2024 and 2025 alone. The group’s reliance on cryptocurrency for laundering their ill-gotten gains is notable; they utilized infrastructure created by criminal organizations in Colombia, Mexico, and Venezuela.
The impact of TdA’s jackpotting scheme has been substantial, with over $40.7 million stolen as of August 2025 according to the US Department of the Treasury’s Office of Foreign Assets Control (OFAC). The US indictment against Canelon Aguirre is part of a larger effort by law enforcement agencies to dismantle TdA’s operations and disrupt their financial networks.
The arrest of Canelon Aguirre marks a significant milestone in the fight against transnational cybercrime. However, it also highlights the sophistication and reach of these criminal organizations. As Eugene Kowel, a special agent in charge with the FBI’s Omaha office, noted, “We are going after the entire jackpotting network, from ringleaders and malware developers to crews in the US.” This commitment is crucial as ATM jackpotting continues to pose a major threat to financial institutions worldwide.
For individuals and businesses, this case underscores the importance of staying vigilant against cyber threats. While the technical aspects of TdA’s operations may seem complex, it’s clear that their success relies on exploiting vulnerabilities in our financial systems. By understanding these risks and implementing robust security measures, we can better protect ourselves from similar attacks in the future.
Source: Dark Reading — 2026-10-08