The FBI's first-ever cyber fugitive placed on its 10 Most Wanted Fugitives list has been returned to the United States after being captured in Venezuela and appeared in a Nebraska courtroom Friday. The development marks a milestone for federal authorities as they intensify efforts against cyber-enabled financial crime networks linked to transnational criminal organizations. The case now moves toward trial, where prosecutors will seek to prove allegations that the suspect helped orchestrate a malware-driven ATM theft operation spanning much of the U.S.
Anibal Alexander Canelon Aguirre, 50, a Venezuelan national also known as "Prometheus" and "The Engineer," pleaded not guilty to four federal conspiracy charges during his initial court appearance. According to the Department of Justice (DOJ), he will remain detained in Nebraska pending trial on charges that include conspiracy to commit bank fraud, money laundering, computer fraud offenses, and providing material support to terrorists. The most serious charge, conspiracy to commit bank fraud, carries a maximum penalty of 30 years in prison.
The money laundering conspiracy count carries a maximum of 20 years, while the material support conspiracy charge carries a maximum of 15 years. The computer fraud-related conspiracy count carries a maximum penalty of five years. A federal grand jury in Nebraska indicted Canelon Aguirre in December 2025.
The DOJ noted that an indictment is an accusation and that Canelon Aguirre is presumed innocent unless and until proven guilty beyond a reasonable doubt. Newsweek has contacted the FBI's Omaha Field Office for additional comment and will update this article if a response is received. Federal authorities describe Canelon Aguirre as one of the alleged leaders of a sprawling ATM jackpotting conspiracy tied to the Venezuelan gang Tren de Aragua, which the U.S. has designated a foreign terrorist organization.
Prosecutors allege he played a central role in developing and deploying malware used to compromise ATMs and force machines to dispense cash without legitimate customer transactions. The FBI elevated the case in March 2026 by adding Canelon Aguirre to its 10 Most Wanted Fugitives list. According to the DOJ, he became both the 540th person ever added to the list and the first cybercriminal to receive the designation.
According to the DOJ, jackpotting attacks involve exploiting vulnerabilities in ATM systems, often through malware, to make machines release cash without recording legitimate withdrawals or debiting customer accounts. Prosecutors allege that Canelon Aguirre developed a form of malware known as Ploutus, software specifically designed to manipulate ATMs into dispensing money on command. The DOJ said the malware allegedly included protections against reverse engineering and debugging, techniques cybersecurity specialists use to analyze malicious code.
Extract — continue reading at the source.
