Apprehended Venezuelan Tren de Aragua Leader on FBI’s 10 Most Wanted Fugitives List Appears in Nebraska Court Following Homeland Security Task Force Investigation

Friday, October 2, 2026 - The Justice Department announced the apprehension of Anibal Alexander Canelon Aguirre also known as “Prometheus” and “The Engineer,” 50, of Venezuela. Anibal Alexander Canelon Aguirre was added to the FBI’s “Top 10 Most Wanted Fugitives” list in March of 2026. Canelon Aguirre was the first cyber criminal and the 540th individual to be added to the Top 10 Most Wanted Fugitives list.

“Since President Trump designated Tren de Aragua a foreign terrorist organization, the Department of Justice has charged nearly 350 of its members and associates with brutal violent crimes,” said Attorney General Todd Blanche. “The capture and arrest of Anibal Alexander Canelon Aguirre marks yet another success for the Homeland Security Task Force and Joint Task Force Vulcan. We will continue to break up narcoterrorist finance networks, prosecute violent criminals, and keep American neighborhoods safe.”

“Anibal Canelon Aguirre served as a key architect of sophisticated malware used to drain ATMs of cash across the United States — technology that helped fuel the criminal operations of the violent transnational organization Tren de Aragua (TdA),” said Assistant Attorney General A. Tysen Duva of the Justice Department’s Criminal Division. “His apprehension sends a clear message: the Criminal Division and our partners will pursue those who attack our financial institutions to support foreign terrorist organizations, wherever they reside across the world.”

“Anibal Alexander Canelon Aguirre is the 10^th member of the Ten Most Wanted Fugitives List captured by this FBI since the beginning of the Trump administration – more than 2.5 times the total captured during the previous four years combined, and the first ever Cyber fugitive,” said FBI Director Kash Patel. “Now Aguirre is back in the United States to face justice, thanks to brilliant work from the FBI’s Cyber Division and Critical Incident Response Group. This fugitive’s return to the United States is the latest in the FBI’s record success manhunting fugitives across the globe, with 107 foreign transfers of custody from 43 countries the last 18 months – an over 90% increase – showing this FBI is using super charged horsepower to chase down violent criminals no matter where they try to hide.”

“There is nowhere that a terrorist indicted in the District of Nebraska can safely hide from justice,” said U.S. Attorney Lesley A. Woods for the District of Nebraska. “We will never stop pursuing those who do harm to the United States for the financial benefit of criminal organizations that are in the full-time business of torture, murder, and trafficking human beings.”

“This case underscores the serious and evolving threat posed by transnational criminal organizations that use sophisticated financial and cyber-enabled schemes to fund violence and destabilize communities,” said Homeland Security Investigations (HSI) Acting Executive Associate Director John A. Condon. “Canelon Aguirre is alleged to have developed technology that enabled criminals to target American financial institutions and generate illicit proceeds for a violent transnational organization. Through the Homeland Security Task Force, HSI and our federal, state, local, and international partners are combining capabilities to pursue the networks, facilitators, and leaders behind these crimes. No border, false identity, or digital disguise will shield those who threaten the safety and security of the American people.”

Canelon Aguirre was indicted by a federal grand jury in the District of Nebraska in December 2025, and is charged with the following counts:

Canelon Aguirre made his initial appearance on Oct. 2 before U.S. Magistrate Judge Michael D. Nelson and entered not guilty pleas to the counts charged. He will remain detained in the District of Nebraska while pending trial. Chief U.S. District Court Judge Brian C. Buescher and U.S. Magistrate Judge Ryan C. Carson are presiding over Canelon Aguirre’s case.

An ATM jackpotting attack is a type of cyberattack where criminals exploit vulnerabilities in an ATM by using malware to force the ATMs to dispense cash without debiting an account. Malware is an abbreviated term for “malicious software” and refers to software programs designed to damage or do other unwanted actions on a computer system. “Ploutus” is a specific type of malware designed to be used in ATM jackpotting to force an ATM to dispense cash.

Canelon Aguirre is alleged to be the developer of the Ploutus malware and one of the principal leaders of ATM jackpotting conspiracy. Ploutus malware consisted of, among other things, files that contained anti-analysis measures to hinder forensic review, specifically software protection utilities to prevent reverse-engineering and debugging. The malware also contained other files that served the function of deleting the malware from the system in an effort to conceal, create a false impression, mislead, or otherwise deceive employees of the financial institution from learning about the deployment of the malware on the ATM.

Canelon Aguirre’s indictment is part of a coordinated investigation and prosecution by the U.S. Attorney’s Office for the District of Nebraska in conjunction with the Department of Justice’s Computer Crime and Intellectual Property Section (CCIPS) of the Department’s Criminal Division and Joint Task Force Vulcan along with the lead investigative agencies the FBI and HSI. This investigation and prosecution are focused on a widespread ATM Jackpotting conspiracy that has been tied to the designated foreign terrorist organization TdA. To date, 120 defendants have been charged in the District of Nebraska for their role in this conspiracy. Three of these defendants have been sentenced in the District of Nebraska:

The investigation has established extensive direct and indirect links between the indicted co-conspirators and TdA. According to court documents, TdA is a violent transnational criminal organization that originated as a prison gang in Venezuela in the mid-2000s. TdA has expanded its criminal network throughout the Western Hemisphere and established a presence in the United States. TdA’s criminal activities range from drug trafficking and firearms trafficking to commercial sex trafficking, kidnapping, robbery, theft, fraud, and extortion. TdA members also commit murder, assault, and other violent acts to advance the organization’s criminal activities. TdA has also developed an additional source of revenue stream through financial crimes that target financial institutions throughout the United States, including using ATM jackpotting to steal millions of dollars in cash. The investigation has revealed that the conspiracy has targeted or carried out ATM jackpotting attacks in 47 states, the District of Columbia, and several foreign nations. 

On Sept. 30, the U.S. Department of the Treasury’s Office of Foreign Assets Control (OFAC) sanctioned Canelon Aguirre.

The Justice Department’s Judicial Attaché in Bogotá and Office of International Affairs, along with the U.S. Secret Service, have provided significant assistance in this matter.

This prosecution is part of the Homeland Security Task Force (HSTF) initiative established by Executive Order 14159, Protecting the American People Against Invasion. The HSTF is a whole-of-government partnership dedicated to eliminating criminal cartels, foreign gangs, transnational criminal organizations, and human smuggling and trafficking rings operating in the United States and abroad. Through historic interagency collaboration, the HSTF directs the full might of United States law enforcement towards identifying, investigating, and prosecuting the full spectrum of crimes committed by these organizations, which have long fueled violence and instability within our borders. In performing this work, the HSTF places special emphasis on investigating and prosecuting those engaged in child trafficking or other crimes involving children. The HSTF further utilizes all available tools to prosecute and remove the most violent criminal aliens from the United States.  HSTF Omaha comprises agents and officers from HSI, FBI, Drug Enforcement Administration (DEA), Bureau of Alcohol, Tobacco, Firearms and Explosives (ATF), U.S. Marshals Service (USMS), U.S. Postal Inspection Service (USPIS), and the IRS Criminal Investigation.

Joint Task Force Vulcan (JTFV) was created in 2019 to eradicate MS-13 and has now expanded to target TdA. JTFV is comprised of U.S. Attorney’s Offices across the country, including Southern and Eastern Districts of New York; Eastern and Western Districts of North Carolina; Western District of Virginia; Middle and Southern Districts of Florida; Eastern District of Texas; Western District of Oklahoma; Northern District of Indiana; District of Nevada; and the District of Arizona, as well as the Executive Office for U.S. Attorneys, and the Department of Justice’s National Security Division, Criminal Division, and the Office of Judicial Attaché and DEA partners in Bogotá, Colombia. Additionally, the FBI, HSI, ATF, USMS, and the Federal Bureau of Prisons are essential law enforcement partners with JTFV.

CCIPS investigates and prosecutes cybercrime and intellectual property (IP) crime in coordination with domestic and international law enforcement agencies, often with assistance from the private sector. Since 2020, CCIPS has secured the conviction of over 180 cyber and IP criminals, and court orders for the return of over $350 million in victim funds.

An indictment is merely an allegation. All defendants are presumed innocent until proven guilty beyond a reasonable doubt in a court of law.

U.S. Department of Justice
Office of Public Affairs
Source: Justice.gov

Read More..

The news, reports, views and opinions of authors (or source) expressed are their own and do not necessarily represent the views of CRWE World.