FBI Arrests First Ever Cyber Fugitive on Top 10 Most Wanted List

U.S.NewsPoliticsTechFact CheckSportsGlobalIran WarRussia-UkraineMiddle EastChina And AsiaLive BlogBetter PlanetAll World NewsLifestyleFamily & ParentingEntertainmentTravelPetsAutomotiveRelationshipsScienceHealthPersonal FinanceBetter WorkplacesReaders ChoiceOpinionMy TurnAll OpinionRankingsHealthFinanceProductsEducationWorkplacesCorporate ResponsibilityAll RankingsWatchThe 1600The Royal ReportUnconventionalFrom The PaddockNewsmakersExtraNewslettersDare to DreamEventsEssaysPodcastsVantageInsightsMagazineCEO CircleAnnouncementsLeadershipDev Pragad The FBI's first-ever cyber fugitive placed on its 10 Most Wanted Fugitives list has been returned to the United States after being captured in Venezuela and appeared in a Nebraska courtroom Friday. The development marks a milestone for federal authorities as they intensify efforts against cyber-enabled financial crime networks linked to transnational criminal organizations. The case now moves toward trial, where prosecutors will seek to prove allegations that the suspect helped orchestrate a malware-driven ATM theft operation spanning much of the U.S. Anibal Alexander Canelon Aguirre, 50, a Venezuelan national also known as "Prometheus" and "The Engineer," pleaded not guilty to four federal conspiracy charges during his initial court appearance. According to the Department of Justice (DOJ), he will remain detained in Nebraska pending trial on charges that include conspiracy to commit bank fraud, money laundering, computer fraud offenses, and providing material support to terrorists. The most serious charge, conspiracy to commit bank fraud, carries a maximum penalty of 30 years in prison. The money laundering conspiracy count carries a maximum of 20 years, while the material support conspiracy charge carries a maximum of 15 years. The computer fraud-related conspiracy count carries a maximum penalty of five years. A federal grand jury in Nebraska indicted Canelon Aguirre in December 2025. The DOJ noted that an indictment is an accusation and that Canelon Aguirre is presumed innocent unless and until proven guilty beyond a reasonable doubt. Newsweek has contacted the FBI's Omaha Field Office for additional comment and will update this article if a response is received. Who Is Anibal Alexander Canelon Aguirre? Federal authorities describe Canelon Aguirre as one of the alleged leaders of a sprawling ATM jackpotting conspiracy tied to the Venezuelan gang Tren de Aragua, which the U.S. has designated a foreign terrorist organization. Prosecutors allege he played a central role in developing and deploying malware used to compromise ATMs and force machines to dispense cash without legitimate customer transactions. The FBI elevated the case in March 2026 by adding Canelon Aguirre to its 10 Most Wanted Fugitives list. According to the DOJ, he became both the 540th person ever added to the list and the first cybercriminal to receive the designation. “Anibal Alexander Canelon Aguirre is the 10th member of the Ten Most Wanted Fugitives List captured by this FBI since the beginning of the Trump administration–more than 2.5 times the total captured during the previous four years combined, and the first ever Cyber fugitive,” FBI Director Kash Patel said in a statement, adding that the agency is “using super charged horsepower to chase down violent criminals no matter where they try to hide.” What Is the ATM Jackpotting Scheme? At the center of the case is a cybercrime technique known as ATM jackpotting. According to the DOJ, jackpotting attacks involve exploiting vulnerabilities in ATM systems, often through malware, to make machines release cash without recording legitimate withdrawals or debiting customer accounts. Prosecutors allege that Canelon Aguirre developed a form of malware known as Ploutus, software specifically designed to manipulate ATMs into dispensing money on command. The DOJ said the malware allegedly included protections against reverse engineering and debugging, techniques cybersecurity specialists use to analyze malicious code. Investigators also said the software contained functions intended to remove traces of its presence from targeted machines after the attacks. Federal authorities have linked the broader conspiracy to ATM attacks in 47 states, Washington, D.C., and several foreign countries. Treasury Department data published in 2025 found that ATM jackpotting attacks had caused more than $40 million in losses nationwide, while an FBI alert issued in 2026 said authorities had identified roughly 1,900 incidents since 2020. Prosecutors allege the conspiracy involving Canelon Aguirre alone caused approximately $5.4 million in losses. How Tren de Aragua Allegedly Profited Investigators contend the ATM theft operation served as a revenue stream for Tren de Aragua, a transnational criminal organization that originated in Venezuela and has expanded across the Western Hemisphere. According to court documents, the group's criminal activity ranges from drug trafficking and firearms offenses to kidnapping, extortion, robbery and human trafficking. The DOJ alleges that members and associates of the organization used ATM jackpotting attacks to generate millions of dollars in illicit proceeds. Authorities say the cyber-enabled theft campaign became an additional funding source alongside the group's more traditional criminal enterprises. Attorney General Todd Blanche said nearly 350 alleged Tren de Aragua members and associates have been charged since the organization was designated a foreign terrorist organization. He described Canelon Aguirre's arrest as another success for the Homeland Security Task Force and Joint Task Force Vulcan, two federal initiatives targeting transnational criminal groups. Assistant Attorney General A. Tysen Duva said the suspect allegedly developed technology that allowed criminals to attack U.S. financial institutions while supporting a violent foreign organization. Federal officials have repeatedly emphasized that the case merges cybercrime, organized crime and national security concerns. FBI Highlights Broader Cybercrime Crackdown Federal officials cast the arrest as part of a broader campaign targeting international criminal organizations that rely on cyber tools to generate revenue. According to the DOJ, the investigation has already resulted in charges against 120 defendants in Nebraska tied to the alleged jackpotting conspiracy. Three defendants previously sentenced in the case received prison terms ranging from 78 months to 96 months, according to prosecutors. Authorities said the investigation was conducted through a partnership involving the FBI, Homeland Security Investigations, the DOJ's Computer Crime and Intellectual Property Section and multiple federal task forces. Patel framed the arrest as evidence of the bureau's expanding international reach. He said the FBI has completed 107 foreign transfers of custody from 43 countries during the past 18 months, while emphasizing that cybercriminals and transnational gang leaders remain a priority for U.S. law enforcement. The Treasury Department's Office of Foreign Assets Control added another layer of pressure this week, sanctioning Canelon Aguirre on September 30 as federal authorities continue to target alleged financial and operational support networks associated with Tren de Aragua. Newsweek’s reporters and editors used Martyn, our AI assistant, to produce this story. Learn more about Martyn here. Contact Newsweek editors for this story: Matthew Robinson and Anthony Murray.By Amanda CastroAssociate News Editor

0ShareNewsweek is a Trust Project memberSee more of our trusted coverage when you search.Prefer Newsweek on Googleto see more of our trusted coverage when you search.The FBI’s first-ever cyber fugitive placed on its 10 Most Wanted Fugitives list has been returned to the United States after being captured in Venezuela and appeared in a Nebraska courtroom Friday.

The development marks a milestone for federal authorities as they intensify efforts against cyber-enabled financial crime networks linked to transnational criminal organizations.

The case now moves toward trial, where prosecutors will seek to prove allegations that the suspect helped orchestrate a malware-driven ATM theft operation spanning much of the U.S.

Anibal Alexander Canelon Aguirre, 50, a Venezuelan national also known as “Prometheus” and “The Engineer,” pleaded not guilty to four federal conspiracy charges during his initial court appearance.

According to the Department of Justice (DOJ), he will remain detained in Nebraska pending trial on charges that include conspiracy to commit bank fraud, money laundering, computer fraud offenses, and providing material support to terrorists.

The most serious charge, conspiracy to commit bank fraud, carries a maximum penalty of 30 years in prison. The money laundering conspiracy count carries a maximum of 20 years, while the material support conspiracy charge carries a maximum of 15 years. The computer fraud-related conspiracy count carries a maximum penalty of five years. A federal grand jury in Nebraska indicted Canelon Aguirre in December 2025.

The DOJ noted that an indictment is an accusation and that Canelon Aguirre is presumed innocent unless and until proven guilty beyond a reasonable doubt.

Newsweek has contacted the FBI’s Omaha Field Office for additional comment and will update this article if a response is received.

Federal authorities describe Canelon Aguirre as one of the alleged leaders of a sprawling ATM jackpotting conspiracy tied to the Venezuelan gang Tren de Aragua, which the U.S. has designated a foreign terrorist organization.

Prosecutors allege he played a central role in developing and deploying malware used to compromise ATMs and force machines to dispense cash without legitimate customer transactions.

The FBI elevated the case in March 2026 by adding Canelon Aguirre to its 10 Most Wanted Fugitives list. According to the DOJ, he became both the 540th person ever added to the list and the first cybercriminal to receive the designation.

“Anibal Alexander Canelon Aguirre is the 10th member of the Ten Most Wanted Fugitives List captured by this FBI since the beginning of the Trump administration–more than 2.5 times the total captured during the previous four years combined, and the first ever Cyber fugitive,” FBI Director Kash Patel said in a statement, adding that the agency is “using super charged horsepower to chase down violent criminals no matter where they try to hide.”

At the center of the case is a cybercrime technique known as ATM jackpotting. According to the DOJ, jackpotting attacks involve exploiting vulnerabilities in ATM systems, often through malware, to make machines release cash without recording legitimate withdrawals or debiting customer accounts.

Prosecutors allege that Canelon Aguirre developed a form of malware known as Ploutus, software specifically designed to manipulate ATMs into dispensing money on command.

The DOJ said the malware allegedly included protections against reverse engineering and debugging, techniques cybersecurity specialists use to analyze malicious code. Investigators also said the software contained functions intended to remove traces of its presence from targeted machines after the attacks.

Federal authorities have linked the broader conspiracy to ATM attacks in 47 states, Washington, D.C., and several foreign countries.

Treasury Department data published in 2025 found that ATM jackpotting attacks had caused more than $40 million in losses nationwide, while an FBI alert issued in 2026 said authorities had identified roughly 1,900 incidents since 2020. Prosecutors allege the conspiracy involving Canelon Aguirre alone caused approximately $5.4 million in losses.

Investigators contend the ATM theft operation served as a revenue stream for Tren de Aragua, a transnational criminal organization that originated in Venezuela and has expanded across the Western Hemisphere. According to court documents, the group’s criminal activity ranges from drug trafficking and firearms offenses to kidnapping, extortion, robbery and human trafficking.

The DOJ alleges that members and associates of the organization used ATM jackpotting attacks to generate millions of dollars in illicit proceeds. Authorities say the cyber-enabled theft campaign became an additional funding source alongside the group’s more traditional criminal enterprises.

Attorney General Todd Blanche said nearly 350 alleged Tren de Aragua members and associates have been charged since the organization was designated a foreign terrorist organization. He described Canelon Aguirre’s arrest as another success for the Homeland Security Task Force and Joint Task Force Vulcan, two federal initiatives targeting transnational criminal groups.

Assistant Attorney General A. Tysen Duva said the suspect allegedly developed technology that allowed criminals to attack U.S. financial institutions while supporting a violent foreign organization.

Federal officials have repeatedly emphasized that the case merges cybercrime, organized crime and national security concerns.

Related StoryWhat Is Tren De Aragua?FBI Highlights Broader Cybercrime CrackdownFederal officials cast the arrest as part of a broader campaign targeting international criminal organizations that rely on cyber tools to generate revenue. According to the DOJ, the investigation has already resulted in charges against 120 defendants in Nebraska tied to the alleged jackpotting conspiracy.

Three defendants previously sentenced in the case received prison terms ranging from 78 months to 96 months, according to prosecutors. Authorities said the investigation was conducted through a partnership involving the FBI, Homeland Security Investigations, the DOJ’s Computer Crime and Intellectual Property Section and multiple federal task forces.

Patel framed the arrest as evidence of the bureau’s expanding international reach. He said the FBI has completed 107 foreign transfers of custody from 43 countries during the past 18 months, while emphasizing that cybercriminals and transnational gang leaders remain a priority for U.S. law enforcement.

The Treasury Department’s Office of Foreign Assets Control added another layer of pressure this week, sanctioning Canelon Aguirre on September 30 as federal authorities continue to target alleged financial and operational support networks associated with Tren de Aragua.

Newsweek’s reporters and editors used Martyn, our AI assistant, to produce this story. Learn more about Martyn here. Contact Newsweek editors for this story: Matthew Robinson and Anthony Murray.