A Venezuelan man accused of designing malware for a transnational ATM-theft network has entered not-guilty pleas in Nebraska after being brought to the United States.
Anibal Alexander Canelon Aguirre appeared before a federal magistrate judge on Friday. He remains detained while the case proceeds. The indictment charges conspiracy to commit bank fraud, computer-enabled bank burglary, money laundering and providing material support to terrorists.
Prosecutors describe Canelon Aguirre as the developer of Ploutus, malware built to make cash machines dispense money without debiting an account. They allege that the software included anti-analysis tools and functions intended to erase evidence after deployment. The government further claims that proceeds from the attacks supported Tren de Aragua, the Venezuelan group the United States has designated as a foreign terrorist organisation.
The broader investigation has produced charges against 120 people in Nebraska and is tied to alleged attacks in 47 states, the District of Columbia and several foreign countries. Canelon Aguirre was placed on the FBI’s most-wanted list in March and was transferred into American custody before the new court appearance. Officials have not publicly described the place or legal mechanism of the apprehension in detail.
The procedural position matters. The December 2025 indictment is an accusation, and Friday’s hearing was an arraignment rather than a determination of guilt. Canelon Aguirre’s pleas put the government to proof on each element, including the claimed connection between the alleged cybercrime and terrorist support.
The case also illustrates how prosecutors are joining ordinary financial-crime statutes to national-security charges. ATM jackpotting begins as theft from a bank. It becomes a materially different case if the government can prove that the people who built or used the tools intended to finance a designated organisation.
