A Venezuelan man accused of helping to lead a multimillion-dollar ATM hacking operation allegedly linked to the Tren de Aragua gang has been apprehended and brought to the United States to face federal charges, the Justice Department announced. Anibal Alexander Canelon Aguirre, 50, known as “Prometheus” and “The Engineer,” is accused by federal prosecutors of being a principal leader of an international conspiracy that used malicious software to force ATMs to dispense cash. Authorities allege the operation generated money for Tren de Aragua, a Venezuelan crime syndicate.
Canelon Aguirre appeared Friday, October 2, before U.S. Magistrate Judge Michael D. Nelson in Nebraska and pleaded not guilty to all four counts against him.
He will remain detained in Nebraska while awaiting trial, the Justice Department said. Newsweek has contacted Canelon Aguirre's legal team and the FBI for comment via email outside office hours. Tren de Aragua originated as a prison gang in Venezuela before expanding across the Western Hemisphere, and U.S. authorities have linked the organization to crimes including drug and firearms trafficking, kidnapping, fraud, extortion, and violent offenses.
The Trump administration designated Tren de Aragua as a foreign terrorist organization in February 2025. Canelon Aguirre was added to the FBI’s Most Wanted Fugitives list in March 2026, becoming the 540th person placed on the list and the first alleged cybercriminal to receive the designation. The Justice Department did not say in its Friday announcement where Canelon Aguirre was apprehended.
Canelon Aguirre was indicted by a federal grand jury in Nebraska in December 2025. He has been charged charged with conspiracy to commit bank fraud, conspiracy to commit bank burglary and fraud in connection with computers, conspiracy to commit money laundering, and conspiracy to provide material support to terrorists. The FBI said Canelon Aguirre was wanted for allegedly leading a large international conspiracy that sent crews into the United States to steal millions of dollars from financial institutions in support of Tren de Aragua.
The alleged scheme had operated since at least January 2024, the agency added. Prosecutors allege Canelon Aguirre developed Ploutus malware used in what is known as “ATM jackpotting.” In such an attack, criminals install malware that forces a cash machine to dispense money without debiting a bank account. The malware allegedly contained protections intended to impede forensic analysis, reverse-engineering, and debugging.
Extract — continue reading at the source.
