America’s first “Top Ten” cyber fugitive is back on U.S. soil and jailed, accused of building malware that made ATMs spit cash on command.
Story Snapshot
- Federal agents returned Aníbal Alexander Canelon Aguirre to Nebraska to face charges tied to ATM “jackpotting.”
- Justice Department officials say he helped lead the scheme and wrote the malware used in the attacks.
- Treasury sanctioned him and his network, linking proceeds to the Tren de Aragua criminal group.
- Prosecutors cite a wider probe with scores of indictments and arrests across countries.
What Happened: A Top Ten Cyber Fugitive Back in Court
Federal prosecutors said Aníbal Alexander Canelon Aguirre, known as “Prometheus” and “The Engineer,” appeared in a Nebraska federal court after capture in Venezuela. The Department of Justice alleges he helped lead an organized network that used custom malware to force ATMs to eject cash without real card authorizations. The court ordered him detained while he awaits trial. Prosecutors brought bank fraud, computer fraud, money laundering, and material-support conspiracy charges in the District of Nebraska.
The Federal Bureau of Investigation placed him on its Ten Most Wanted Fugitives list as its first cyber-focused target before his apprehension. Officials say his capture marks a milestone in a long-running case that hit banks and vendors in several states. Authorities tie the plot to repeatable “jackpotting” methods used by traveling cash-out crews. The Justice Department states the investigation has already produced more than one hundred federal indictments and dozens of arrests across borders.
How the Scheme Worked: Malware and Traveling Cash-Out Crews
Investigators describe a clear method: attackers loaded malware onto targeted ATMs, took control of the payout function, and triggered rapid cash dumps. Operators on the ground collected the bills and moved on. Prosecutors allege Canelon Aguirre developed or directed the malware at the core of the operation, and that his network coordinated crews and money flows across jurisdictions. One Nebraska City incident listed in the case materials cites about nineteen thousand dollars in illegal proceeds.
The Justice Department’s narrative aligns with a broader pattern seen in past cases, where a central tool and playbook enable a string of thefts in different cities. The method exploits weak points in machine software and service routines, then relies on speed to cash out before banks can respond. Authorities say this network used those tactics over years, which drove the Federal Bureau of Investigation and partners to prioritize the case and pursue extradition or transfers when suspects surfaced abroad.
Why It Matters: Links to a Violent Transnational Network
The Department of the Treasury sanctioned Canelon Aguirre and related actors, calling him the alleged engineer behind the jackpotting malware and linking the proceeds to Tren de Aragua, a violent criminal group. Treasury described photos of him posing with cash and said the network funded broader crimes, including trafficking and drug activity. The sanctions target individuals and companies believed to support the scheme’s finance and logistics pipeline across borders.
Justice Department officials say the case is part of a wider push using indictments, arrests, and sanctions to disrupt transnational crime. They highlight joint work by prosecutors, the Federal Bureau of Investigation, and foreign partners. Reported figures include more than one hundred twenty federal indictments and about seventy arrests tied to related efforts. The Nebraska case joins this larger map, where cyber tools fuel old-school cash theft while proceeds help fund violent networks that burden communities far from the crime scene.
The Stakes for Everyday Americans: Banks, Security, and Trust
Banks and customers pay when machines are looted, whether through higher fees, insurance costs, or delayed access to cash during shutdowns. Communities lose trust when foreign criminal networks tap local machines and move money overseas. This case shows how code written in one place can drain a small-town ATM in minutes. Federal officials argue that fast arrests, court action, and sanctions are needed to raise the cost of these schemes and keep cash systems working safely.
What Comes Next: Detention, Discovery, and Trial
The Nebraska court will manage the case timeline, including discovery and pretrial motions. Prosecutors will present their evidence, and defense counsel can challenge it. The Department of Justice emphasized that an indictment is an accusation, not proof of guilt, and Canelon Aguirre remains presumed innocent until proven guilty. For now, detention keeps him in U.S. custody while the court process unfolds on the charges tied to the alleged jackpotting conspiracy.
Sources:
foxnews.com, upi.com, home.treasury.gov, ia800503.us.archive.org
