Anibal Alexander Canelon Aguirre has been apprehended.
OMAHA, NE – October 3, 2026 (STL.News) A Venezuelan man accused of helping lead an international cybercrime operation that used malware to force ATMs across the United States to dispense millions of dollars has been apprehended and brought to Nebraska to face federal charges, according to the U.S. Department of Justice.
Anibal Alexander Canelon Aguirre, 50, also known as “Prometheus” and “The Engineer,” appeared in federal court in Omaha on Oct. 2 and pleaded not guilty to four conspiracy charges involving bank fraud, computer crimes, money laundering, and providing material support to terrorists.
The FBI placed Canelon Aguirre on its Ten Most Wanted Fugitives list in March 2026. According to the Justice Department, he was the 540th person added to the list and the first cyber fugitive to receive the designation.
Federal authorities allege Canelon Aguirre was one of the principal leaders of a sprawling ATM “jackpotting” conspiracy and served as a key architect of the malicious software used by the organization.
The investigation has grown dramatically since arrests in Nebraska helped expose the alleged network.
As of Oct. 2, the Justice Department said it had charged 120 defendants in the District of Nebraska in connection with the broader jackpotting conspiracy.
Investigators say the conspiracy targeted or conducted ATM jackpotting attacks in 47 states, the District of Columbia and several foreign countries.
Federal authorities have also alleged extensive direct and indirect connections between indicted participants and Tren de Aragua, or TdA, a Venezuelan organization designated by the U.S. government as a Foreign Terrorist Organization.
Canelon Aguirre remains detained in Nebraska pending trial.
What is ATM jackpotting?
ATM jackpotting is fundamentally different from conventional debit-card fraud.
Instead of stealing a customer’s account information and withdrawing money from that person’s bank account, jackpotting attackers compromise an ATM itself and manipulate the machine into dispensing cash without an authorized banking transaction.
The FBI says criminals exploit physical and software vulnerabilities in ATMs and install malware that issues unauthorized commands to a machine’s cash-dispensing system.
Federal prosecutors allege the conspiracy involving Canelon Aguirre used a variant of the Ploutus malware family.
Ploutus malware predates the alleged conspiracy. However, federal authorities allege Canelon Aguirre engineered or developed the malware used by this particular jackpotting network.
According to federal court documents and Justice Department descriptions of the conspiracy, crews would first conduct surveillance of potential ATM targets.
Participants allegedly examined ATMs and their security systems before gaining physical access to the machines.
The Justice Department says the alleged conspiracy used methods that included removing an ATM hard drive and installing malware directly, replacing a hard drive with one already containing malicious software, or connecting an external device capable of deploying the malware.
Once the malware was installed and activated, conspirators could allegedly send unauthorized commands to the ATM’s cash-dispensing module.
The machine could then be ordered to dispense currency without a legitimate customer withdrawal.
Cash collectors could remove the money before participants divided the proceeds.
Malware allegedly designed to conceal attacks
Federal prosecutors say the malware in the Canelon Aguirre case was designed not only to manipulate ATMs but also to make forensic investigations harder.
According to the Justice Department, files associated with the malware contained anti-analysis protections intended to hinder reverse engineering and debugging.
Other files allegedly allowed the malicious software to delete itself from compromised systems.
Prosecutors contend those features were meant to conceal evidence of the malware and make it harder for financial institutions to determine how their ATMs were compromised.
The ability to remove evidence is significant because jackpotting attacks involve both a physical intrusion into an ATM and a subsequent cyberattack against the machine’s computer system.
Charged conspiracy involved millions in losses
Loss figures associated with the nationwide jackpotting problem require careful distinction because federal authorities have released several numbers covering different investigations, defendants, and time periods.
The federal indictment involving Canelon Aguirre alleges about $5.4 million in actual losses and about $1.43 million in attempted losses tied to the charged conspiracy.
Those figures should not be confused with nationwide ATM jackpotting losses reported by federal agencies.
The Justice Department has said the alleged conspiracy involving Canelon Aguirre and his co-defendants targeted banks and credit unions across the country.
A December 2025 Justice Department announcement describing the indictment said the alleged network conducted reconnaissance at targeted ATMs before members opened ATM doors or hoods and waited nearby to determine whether their actions triggered alarms or a law-enforcement response.
Participants would then allegedly return and install the malicious software.
Prosecutors said the proceeds were then divided in predetermined portions.
$40.73 million reported nationally
The broader national ATM jackpotting problem is considerably larger than the loss amount alleged in Canelon Aguirre’s specific indictment.
On Sept. 30, the Treasury Department’s Office of Foreign Assets Control said reported losses from alleged ATM jackpotting attacks in the United States totaled approximately $40.73 million across more than 1,500 attacks as of August 2025.
That is a national figure and should not be interpreted as the amount personally stolen by Canelon Aguirre or the loss attributed exclusively to his federal criminal case.
The FBI has independently documented a sharp increase in jackpotting.
In a February 2026 cyber alert, the bureau said approximately 1,900 ATM jackpotting incidents had been reported since 2020.
More than 700 of those incidents occurred during 2025, resulting in more than $20 million in losses during that year alone, according to the FBI.
The figures indicate that jackpotting accelerated significantly during 2025.
What about the reported $61 million?
Some reporting following Canelon Aguirre’s apprehension has cited approximately $61 million in losses connected to his alleged criminal activity.
However, that figure does not appear in the Justice Department’s Oct. 2 announcement of his apprehension.
It also should not be substituted for the substantially smaller loss amount alleged in the federal indictment against Canelon Aguirre and his co-defendants.
The indictment, Treasury’s nationwide figures, and the FBI’s national statistics measure different sets of alleged attacks over different periods.
For that reason, the $61 million figure should not be characterized as a court-established loss caused by Canelon Aguirre.
The clearest figures from primary federal sources are about $5.4 million in actual losses, $1.43 million in attempted losses alleged in the charged conspiracy, and $40.73 million in reported losses across more than 1,500 alleged jackpotting attacks nationwide as of August 2025.
Alleged Tren de Aragua connections
The case extends beyond conventional cybercrime because federal authorities allege the jackpotting network had connections to Tren de Aragua.
TdA originated in Venezuela and expanded into other parts of the Western Hemisphere.
The U.S. government designated the organization as a Foreign Terrorist Organization in February 2025.
Federal prosecutors allege TdA has used financial crimes, including ATM jackpotting, as a source of revenue.
The Justice Department says its investigation established extensive direct and indirect connections between indicted co-conspirators and TdA.
Treasury has made similar allegations.
On Sept. 30, just two days before Canelon Aguirre’s Nebraska court appearance, Treasury’s Office of Foreign Assets Control sanctioned Canelon Aguirre and other people and entities accused of participating in a financial network associated with TdA.
Treasury alleged the jackpotting operation generated revenue for the organization and said it transferred proceeds among TdA members and associates to conceal the illicit origins of the money.
Treasury also alleged that the network used cryptocurrency transactions to launder jackpotting proceeds.
Those assertions remain allegations and should not be interpreted as jury findings in Canelon Aguirre’s criminal case.
Material-support charge requires careful distinction
Canelon Aguirre’s fourth federal charge is conspiracy to provide material support to terrorists.
The terrorism-related charge should not be interpreted as an allegation that Canelon Aguirre personally carried out a terrorist attack.
Instead, the charge arises from prosecutors’ allegations concerning the jackpotting conspiracy, its alleged connections to TdA and the use of property, services and other resources in connection with specified criminal activity.
If the case proceeds to trial, the government must prove the elements of that charge beyond a reasonable doubt.
Canelon Aguirre has pleaded not guilty.
Treasury targeted network before apprehension announced
Treasury’s Sept. 30 sanctions action provides more detail on how federal authorities view Canelon Aguirre’s alleged role.
OFAC described him as the alleged leader of a large international conspiracy that deployed crews into the United States to steal millions of dollars from financial institutions.
Treasury also described Canelon Aguirre as the alleged engineer of malware used in the jackpotting attacks.
The sanctions action targeted 10 people and entities allegedly involved in the TdA-related fraud scheme.
Treasury said the network used cryptocurrency to launder proceeds.
OFAC sanctions generally block property and interests in property belonging to designated persons when those assets are in the United States or under the possession or control of U.S. persons. Transactions involving designated parties are generally prohibited unless authorized by OFAC.
120 defendants charged in Nebraska investigation
Canelon Aguirre’s prosecution is part of a much larger federal investigation centered in Nebraska.
The Justice Department said Oct. 2 that it charged 120 defendants in the District of Nebraska in connection with the jackpotting conspiracy.
Three defendants have already been sentenced.
Oddry Arnoldo Cabrera Torrealba received 78 months in federal prison.
Carlos Javier Padron also received 78 months.
Juan Manuel Gouveia Aguilera received 96 months in federal prison.
Their cases are procedurally different from Canelon Aguirre’s case because those defendants have already been convicted and sentenced.
Canelon Aguirre has not.
Nebraska arrests helped expose broader operation
Nebraska has played an unusually prominent role in the nationwide investigation.
The broader federal probe grew after law enforcement encountered suspected jackpotting crews operating against financial institutions in the state.
The resulting investigation eventually expanded far beyond Nebraska and identified alleged participants, facilitators, malware developers and money-moving networks operating nationally and internationally.
In December 2025, federal prosecutors announced indictments against 54 people in two related cases.
One indictment returned Dec. 9 charged 22 defendants with offenses connected to the alleged conspiracy, including bank fraud, bank burglary and computer fraud, money laundering and conspiracy to provide material support to terrorists.
A separate indictment returned Oct. 21, 2025, charged 32 defendants.
The investigation continued expanding throughout 2026, ultimately reaching the 120 defendants announced by the Justice Department following Canelon Aguirre’s apprehension.
First cyber fugitive on FBI Ten Most Wanted list
Canelon Aguirre’s case also marked a milestone for the FBI.
The bureau added him to its Ten Most Wanted Fugitives list in March 2026.
The Justice Department says he was the first cyber fugitive ever placed on the list.
His addition reflected the government’s allegation that Canelon Aguirre occupied an unusually important position at the intersection of cybercrime and organized criminal activity.
Unlike a conventional hacker operating entirely online, the alleged jackpotting operation depended on coordination among malware developers, remote operators, and physical crews entering the United States to attack individual ATMs.
The FBI and Justice Department have described Canelon Aguirre as one of the alleged principal leaders of that operation.
The Justice Department announced his apprehension Oct. 2 but did not provide detailed public information in its announcement about precisely where or how he was taken into custody.
The department said he is now back in the United States to face the charges.
Four federal conspiracy charges
Canelon Aguirre faces four counts in the District of Nebraska:
- Conspiracy to commit bank fraud, carrying a maximum possible penalty of 30 years in prison, a $1 million fine and up to five years of supervised release.
- Conspiracy to commit bank burglary and fraud in connection with computers, carrying a maximum possible penalty of five years in prison, a $250,000 fine and up to three years of supervised release.
- Conspiracy to commit money laundering, carrying a maximum possible penalty of 20 years in prison, a $500,000 fine or twice the value of the property or funds involved, and up to three years of supervised release.
- Conspiracy to provide material support to terrorists, carrying a maximum possible penalty of 15 years in prison, a $250,000 fine and up to three years of supervised release.
Those are statutory maximum penalties and are not predictions of the sentence Canelon Aguirre would receive if convicted.
Actual federal sentences depend on the offenses of conviction, applicable federal sentencing guidelines, and other factors the court considers.
Aguirre pleads not guilty
Canelon Aguirre made his initial appearance Oct. 2 before U.S. Magistrate Judge Michael D. Nelson in Nebraska and entered not guilty pleas to all four counts.
The Justice Department said he will remain detained in Nebraska pending trial.
Chief U.S. District Judge Brian C. Buescher and U.S. Magistrate Judge Ryan C. Carson are assigned to the case.
The investigation involves the FBI, Homeland Security Investigations, the U.S. Attorney’s Office for the District of Nebraska, the Justice Department’s Computer Crime and Intellectual Property Section and Joint Task Force Vulcan, among other federal agencies and law-enforcement partners.
Federal authorities are portraying the investigation as an effort to dismantle an entire alleged network — from the people developing malicious software to crews physically attacking ATMs and people allegedly moving or laundering the proceeds.
With Canelon Aguirre now in federal custody, prosecutors must prove their allegations against one of the investigation’s highest-profile defendants.
Legal note: An indictment is an accusation, not evidence of guilt. Anibal Alexander Canelon Aguirre has pleaded not guilty and is presumed innocent unless and until proven guilty beyond a reasonable doubt in a court of law.
