FBI TOP 10 FUGITIVE AND ALLEGED TREN DE ARAGUA CYBER LEADER RETURNED TO UNITED STATES IN EXPANDING ATM JACKPOTTING CASE

OMAHA, Neb. — The Realist Juggernaut reported on the sprawling Tren de Aragua-linked ATM jackpotting conspiracy on October 1, detailing federal indictments against 54 defendants and the alleged use of Ploutus malware to force ATMs across the United States to dispense cash. One of the central defendants identified in that case, Anibal Alexander Canelon Aguirre, has now been apprehended, returned to the United States and brought before a federal court in Nebraska.

Canelon Aguirre, 50, a Venezuelan national also known as “Prometheus” and “The Engineer,” was added to the FBI’s Ten Most Wanted Fugitives list in March 2026. The Justice Department identified him as the 540th person added to the list and the first fugitive placed on it primarily in connection with alleged cybercriminal activity.

He was indicted by a federal grand jury in the District of Nebraska in December 2025 and is accused of helping develop and operate technology used in a widespread ATM jackpotting scheme that investigators have tied to Tren de Aragua.

Canelon Aguirre appeared October 2 before U.S. Magistrate Judge Michael D. Nelson and entered not guilty pleas to the charges. He remains detained in the District of Nebraska while awaiting further proceedings. Chief U.S. District Judge Brian C. Buescher and U.S. Magistrate Judge Ryan C. Carson are presiding over the case.

The indictment charges Canelon Aguirre with conspiracy to commit bank fraud, conspiracy to commit bank burglary and fraud in connection with computers, conspiracy to commit money laundering, and conspiracy to provide material support to terrorists.

The bank fraud conspiracy charge carries a maximum possible sentence of 30 years in prison, a fine of up to $1 million and as much as five years of supervised release. The computer-related conspiracy carries up to five years in prison, a $250,000 fine and three years of supervised release. The money laundering conspiracy carries up to 20 years in prison, a fine of up to $500,000 or twice the value of the property or funds involved, and three years of supervised release, while the material support conspiracy carries a maximum penalty of 15 years in prison, a $250,000 fine and three years of supervised release.

At the center of the case is a cyber-enabled theft technique known as ATM jackpotting. The method involves manipulating an automated teller machine through malware or unauthorized access so that it dispenses cash without conducting a legitimate withdrawal from a customer account.

Federal prosecutors allege Canelon Aguirre developed Ploutus malware used in jackpotting attacks and served as one of the principal leaders of the broader conspiracy.

According to the government, Ploutus was designed to force compromised ATMs to release cash and contained anti-analysis measures intended to make forensic review, reverse engineering and debugging more difficult. Investigators also allege that portions of the malware were designed to remove the malicious software from compromised systems, making it harder for financial institutions to determine how the ATM had been breached.

The updated federal announcement and court appearance expand the scope of the investigation beyond the 54 defendants highlighted in the October 1 indictments. Federal authorities now say 120 defendants have been charged in the District of Nebraska in connection with the broader ATM jackpotting conspiracy.

That larger figure reflects the continuing expansion of the investigation rather than a contradiction with the earlier indictments. The 54 defendants reported by TRJ were charged in two specific federal indictments, while the current total represents defendants charged across the wider Nebraska investigation.

Three defendants have already been sentenced in the District of Nebraska. Oddry Arnoldo Cabrera Torrealba and Carlos Javier Padron each received 78 months in federal prison, while Juan Manuel Gouveia Aguilera was sentenced to 96 months.

Investigators say the conspiracy has targeted or carried out ATM jackpotting attacks in 47 states, the District of Columbia and several foreign countries. Authorities allege the operation stole millions of dollars from financial institutions and involved an organized structure extending from malware developers and alleged leaders to crews responsible for physically accessing and compromising ATMs.

The prosecution therefore reaches beyond a traditional bank fraud case. Investigators are examining a network that allegedly combined malware development, financial crime, money laundering, physical ATM access and transnational criminal organization activity.

Court documents cited by federal authorities describe Tren de Aragua as a violent transnational criminal organization that originated as a prison gang in Venezuela during the mid-2000s before expanding throughout the Western Hemisphere and establishing a presence in the United States.

Federal investigators have associated the organization with drug trafficking, firearms trafficking, commercial sex trafficking, kidnapping, robbery, theft, fraud, extortion, murder and assault. The Nebraska investigation alleges that ATM jackpotting and related financial crimes became another method for generating illicit revenue.

The federal government has designated Tren de Aragua as a foreign terrorist organization, making the alleged financial relationship between jackpotting proceeds and the group a major component of the prosecution against Canelon Aguirre.

Attorney General Todd Blanche said the Justice Department has charged nearly 350 alleged Tren de Aragua members and associates since the organization received the foreign terrorist designation. He described Canelon Aguirre’s apprehension as another enforcement action involving the Homeland Security Task Force and Joint Task Force Vulcan.

U.S. Attorney Lesley A. Woods for the District of Nebraska said authorities would continue pursuing individuals accused of committing crimes in the United States for the financial benefit of violent transnational organizations.

Assistant Attorney General A. Tysen Duva of the Justice Department’s Criminal Division described Canelon Aguirre as an alleged architect of malware used to drain ATMs across the country and said the department intends to pursue cybercriminals accused of using technology to support violent organizations regardless of where they operate.

FBI Director Kash Patel said Canelon Aguirre became the 10th member of the FBI’s Ten Most Wanted Fugitives list captured since the beginning of the current administration and identified him as the first cyber fugitive placed on the list.

Patel also credited the FBI Cyber Division and Critical Incident Response Group with work leading to Canelon Aguirre’s return to the United States. He said the FBI has completed 107 foreign transfers of custody from 43 countries during the previous 18 months.

Homeland Security Investigations Acting Executive Associate Director John A. Condon said the case demonstrates how transnational criminal organizations can combine cyber capabilities with financial crime to support broader criminal operations. He said the Homeland Security Task Force is intended to bring federal, state, local and international resources together against networks, facilitators and alleged leaders operating across national borders.

FBI Omaha Special Agent in Charge Eugene Kowel said the investigation is targeting the entire jackpotting network, including alleged leaders, malware developers and crews operating in the United States. He said investigators will continue following financial activity and directing resources toward individuals believed to be involved.

The prosecution is being handled by the U.S. Attorney’s Office for the District of Nebraska together with the Justice Department’s Computer Crime and Intellectual Property Section and Joint Task Force Vulcan. The FBI and Homeland Security Investigations are the lead investigative agencies.

The Justice Department’s Judicial Attaché in Bogotá, Office of International Affairs and the U.S. Secret Service have also provided assistance.

The case is part of the Homeland Security Task Force initiative, which brings together agencies including HSI, the FBI, Drug Enforcement Administration, Bureau of Alcohol, Tobacco, Firearms and Explosives, U.S. Marshals Service, U.S. Postal Inspection Service and IRS Criminal Investigation.

Joint Task Force Vulcan, originally created in 2019 to target MS-13, has expanded its mission to include Tren de Aragua and now coordinates multiple U.S. Attorney’s Offices, Justice Department components and federal law enforcement agencies in cases involving transnational criminal organizations.

The Computer Crime and Intellectual Property Section is involved because of the alleged development and use of malware against financial institutions. Since 2020, the Justice Department says CCIPS has secured convictions against more than 180 cyber and intellectual property offenders and obtained court orders directing the return of more than $350 million in victim funds.

Canelon Aguirre remains detained pending trial. His not guilty pleas mean the government must still prove the allegations against him beyond a reasonable doubt in court.

---

---

---

---

FEDERAL GRAND JURY CHARGES 54 IN MULTI-MILLION-DOLLAR TREN DE ARAGUA ATM JACKPOTTING CONSPIRACY

---

---

---

---

---

---

---

---

🔥 NOW AVAILABLE! 🔥

‎👉 Eclipsera – Apple Music

---

---

---

---

---