A Venezuelan man accused of helping lead a massive operation that forced ATMs across the United States to dispense millions of dollars has been captured and brought before a federal court in Nebraska.
Canelon Aguirre is accused of developing Ploutus, malware specifically designed to manipulate ATMs and make them release cash without legitimate withdrawals. US prosecutors describe him as one of the principal leaders behind the international ATM jackpotting operation.
The FBI had placed Aguirre on its Ten Most Wanted Fugitives list. Following his arrest, he appeared in a Nebraska federal court on October 2 and pleaded not guilty to the charges against him. He will remain in custody while awaiting trial.
ATM jackpotting involves gaining physical access to an ATM and installing malicious software or hardware that can control its cash dispenser. Members of the alleged conspiracy used several methods, including replacing ATM hard drives, modifying existing drives, and connecting external devices loaded with malware.
Once Ploutus was running, operators could issue unauthorized commands that caused the ATM to dispense its cash. The malware also contained features intended to make forensic analysis more difficult and remove evidence after an attack.
US authorities say the wider conspiracy targeted ATMs in 47 states, Washington, DC, and several foreign countries. The operation allegedly stole millions of dollars from banks and credit unions.
Investigators have linked members of the conspiracy directly and indirectly to Tren de Aragua, the Venezuelan criminal organization designated by the US government as a foreign terrorist organization. Prosecutors allege that money generated through ATM attacks helped support the group’s broader activities.
The investigation has expanded significantly. Authorities say 120 defendants have now been charged in Nebraska in connection with the alleged conspiracy, while several participants have already received prison sentences.
Aguirre faces charges including conspiracy to commit bank fraud, computer-related offenses, money laundering and conspiracy to provide material support to terrorists. The most serious counts carry potential prison sentences of up to 30 years.