Anibal Alexander Canelon Aguirre, 50, was captured in Venezuela, returned to the U.S. and pleaded not guilty in a Nebraska federal court to four conspiracy counts. Prosecutors allege he helped develop the Ploutus malware used in ATM "jackpotting" attacks tied to Tren de Aragua, causing about $5.4 million in alleged losses. Authorities say the broader jackpotting campaign affected 47 states and D.C. and has produced roughly 120 related charges in Nebraska; OFAC also sanctioned Canelon Aguirre. The case now moves toward trial, with the DOJ emphasizing that an indictment is only an accusation.
FBI’s First 'Cyber' Most-Wanted Fugitive, Anibal Canelon Aguirre, Returned to U.S.; Faces Trial in Nebraska
Captured in Venezuela, alleged cybercrime leader Anibal Canelon Aguirre now awaits trial in Nebraska.
Anibal Alexander Canelon Aguirre, 50, a Venezuelan national also known by the aliases "Prometheus" and "The Engineer," has been returned to the United States after his capture in Venezuela and made an initial appearance in a Nebraska federal courtroom on Friday.
Federal prosecutors say the arrest marks a significant step in a broad investigation into cyber-enabled financial crime networks tied to transnational criminal groups. Canelon Aguirre pleaded not guilty to four federal conspiracy counts and will remain detained in Nebraska pending trial.
Charges and Potential Penalties
According to the Department of Justice, a federal grand jury in Nebraska indicted Canelon Aguirre in December 2025 on counts that include:
- Conspiracy to Commit Bank Fraud (maximum statutory term: 30 years)
- Money Laundering Conspiracy (maximum: 20 years)
- Conspiracy To Provide Material Support To Terrorists (maximum: 15 years)
- Computer Fraud-Related Conspiracy (maximum: 5 years)
The Justice Department noted that an indictment is an accusation and that Canelon Aguirre is presumed innocent unless and until proven guilty beyond a reasonable doubt.
Alleged Role And Malware
Prosecutors allege Canelon Aguirre played a central role in developing and deploying a form of malware known as Ploutus, which investigators say was used to compromise ATMs and coerce machines into dispensing cash without legitimate customer transactions — a technique commonly called "jackpotting." The DOJ says the malware included features to frustrate reverse engineering and debugging and functions intended to remove traces of its presence after attacks.
Scope Of The Alleged Conspiracy
Federal authorities have tied the broader investigation to ATM attacks across 47 U.S. states, the District of Columbia and multiple countries abroad. Prosecutors allege the subset of activity associated with Canelon Aguirre caused roughly $5.4 million in losses. The Treasury published data in 2025 estimating that ATM jackpotting had caused more than $40 million in losses nationwide, while an FBI alert in 2026 identified approximately 1,900 jackpotting incidents since 2020.
Links To Tren de Aragua
Authorities say the alleged ATM theft scheme served as a revenue stream for Tren de Aragua, a transnational criminal organization that originated in Venezuela and has been designated a foreign terrorist organization by the U.S. government. Court documents describe the group’s broader criminal activities as including drug trafficking, firearms offenses, kidnapping, extortion, robbery and human trafficking.
Enforcement And International Cooperation
The FBI elevated the case in March 2026 by adding Canelon Aguirre to its Ten Most Wanted Fugitives list — the DOJ says he was the 540th person placed on the list and the first individual described primarily as a "cyber" fugitive. FBI Director Kash Patel said the arrest reflects the bureau’s expanding international reach and its focus on pursuing cybercriminals and transnational gang leaders.
Federal partners in the investigation and prosecution include the FBI, Homeland Security Investigations, the DOJ’s Computer Crime and Intellectual Property Section, and multiple federal task forces. The probe has produced charges against roughly 120 defendants in Nebraska tied to the alleged jackpotting conspiracy; three previously sentenced defendants received prison terms of 78 to 96 months.
Sanctions And Next Steps
In parallel with criminal proceedings, the Treasury Department’s Office of Foreign Assets Control (OFAC) sanctioned Canelon Aguirre on September 30 as authorities continued to target alleged financial and operational support networks linked to Tren de Aragua.
As the case moves toward trial, prosecutors will seek to present evidence tying Canelon Aguirre to the development and deployment of malicious software and to the money flows that allegedly benefited the transnational organization. Defense counsel has entered a not-guilty plea and the defendant remains in custody pending further proceedings.
Note: All allegations described above come from charging documents and public statements by federal authorities. An indictment is not a conviction.
Help us improve.
