Venezuelan Cartel's Cyber Evolution: How Tren de Aragua Weaponized ATM Malware
In October 2026, US authorities arrested Anibal Alexander Canelon Aguirre, a 50-year-old Venezuelan member of the Tren de Aragua criminal cartel and the first cybercriminal ever placed on the FBI's Ten Most Wanted Fugitives list. Canelon Aguirre, known as "Prometheus" and "The Engineer," was the principal architect of the Ploutus-D malware used in ATM jackpotting schemes that compromised cash machines across Latin and North America. The cartel physically implanted malware into ATMs, allowing remote control to dispense cash to money mules, then laundered over $5.1 million through Venezuelan, Mexican, and Colombian cryptocurrency networks including TRON. This case demonstrates how traditional criminal organizations are increasingly integrating sophisticated cyber capabilities into their operations. The convergence of physical access, custom malware development, and cryptocurrency laundering represents a new evolution in organized crime that bridges cybercrime with terrorist financing and transnational criminal enterprises.
Kill Chain
