A alleged architect of sophisticated malware used to drain ATMs of cash across the United States for the Tren de Aragua gang is in the custody of U.S. Marshals in Omaha. He will remain there pending trial.

Anibal Alexander Canelon Aguirre of Venezuela, also known as “Prometheus” and “The Engineer,” was added to the FBI’s “Top 10 Most Wanted Fugitives” list in March.

Canelon Aguirre, 50, is charged with conspiracy to commit bank fraud, bank burglary, launder money and fund terrorism. He faces a maximum of 75 years in prison if convicted on all charges. He entered not guilty pleas on Oct. 2.

He is alleged to be one of the principal leaders of ATM jackpotting conspiracy and the developer of Ploutus malware that aimed to cover the tracks of the burglars.

In an ATM jackpotting attack, malware is deployed to force the ATMs to dispense cash without debiting an account. Malware is an abbreviated term for “malicious software” and refers to programs designed to damage or do other unwanted actions on a computer system. “Ploutus” is a specific type of malware designed to be used in ATM jackpotting to force an ATM to dispense cash.

Three jackpotting suspects were arrested in North Platte in March 2025.

Law officers said Ploutus malware consisted of, among other things, anti-analysis measures to hinder forensic review, specifically software to prevent reverse-engineering and debugging. The malware also served the function of deleting the malware from the system in an effort to conceal, create a false impression, mislead, or otherwise deceive employees of the financial institution from learning about the deployment of the malware on the ATM.

Canelon Aguirre will remain detained in the District of Nebraska for trial. Chief U.S. District Court Judge Brian C. Buescher and U.S. Magistrate Judge Ryan C. Carson are presiding over the case.

The arrest is part of an ambitious and so far, apparently successful effort to take down the Tren de Aragua gang. According to court documents, TdA originated as a prison gang in Venezuela in the mid-2000s and expanded its criminal network throughout the western hemisphere, including the United States.

“This fugitive’s return to the United States is the latest in the FBI’s record success manhunting fugitives across the globe, with 107 foreign transfers of custody from 43 countries the last 18 months – an over 90% increase – showing this FBI is using super-charged horsepower to chase down violent criminals no matter where they try to hide,” FBI Director Kash Patel said.

The U.S. Justice Department says that TdA’s criminal activities range from drug trafficking and firearms trafficking to commercial sex trafficking, kidnapping, robbery, theft, fraud, and extortion. TdA members also commit murder, assault, and other violent acts to advance the organization’s criminal activities.

“We are going after the entire jackpotting network, from ringleaders and malware developers to crews in the U.S. We will continue to follow the money and surge resources to arrest and apprehend TdA members and leadership,” said FBI Omaha Special Agent in Charge Eugene Kowel. “FBI Omaha will continue working side-by-side with our local, state, and federal partners to dismantle and disrupt the activities of TdA in our communities.”

TdA allegedly developed an additional source of revenue through financial crimes that target financial institutions throughout the U.S., including ATM jackpotting to steal millions of dollars in cash. The investigation revealed that the conspiracy has targeted or carried out ATM jackpotting attacks in 47 states, the District of Columbia, and several foreign nations, the Justice Department said.

Patel said, “Anibal Alexander Canelon Aguirre is the 10th member of the Ten Most Wanted Fugitives List captured by this FBI since the beginning of the Trump administration – more than 2.5 times the total captured during the previous four years combined, and the first ever cyber fugitive. Now Aguirre is back in the United States to face justice, thanks to brilliant work from the FBI’s Cyber Division and Critical Incident Response Group.”

U.S. Attorney General Todd Blanche said, “Since President Trump designated Tren de Aragua a foreign terrorist organization, the Department of Justice has charged nearly 350 of its members and associates with brutal violent crimes. We will continue to break up narco-terrorist finance networks, prosecute violent criminals, and keep American neighborhoods safe.”

To date, 120 defendants have been charged in the District of Nebraska for their role in the jackpotting conspiracy. Three defendants have been sentenced in the District of Nebraska:

• Oddry Arnoldo Cabrera Torrealba — 78 months in prison
• Carlos Javier Padron — 78 months
• Juan Manuel Gouveia Aguilera — 96 months

An indictment is merely an allegation. All defendants are presumed innocent until proven guilty beyond a reasonable doubt in a court of law, the announcement said. The Justice Department’s Judicial Attaché in Bogotá and Office of International Affairs, along with the U.S. Secret Service, provided significant assistance in the case.

© 2026 The North Platte Bulletin. All rights reserved!