FBI’s First Cyber Top-10 Fugitive, Tren de Aragua’s ‘Prometheus,’ Pleads Not Guilty in Nebraska — Treasury Says His ATM-Draining Network Is Based in Mexico and Venezuela
Anibal Alexander Canelon Aguirre, the Venezuelan alleged to be Tren de Aragua’s ATM-hacking “engineer” and the first cyber criminal ever placed on the FBI’s Ten Most Wanted list, pleaded not guilty in federal court in Nebraska on Friday, Oct. 2, 2026, the Justice Department said. Two days earlier, the U.S. Treasury sanctioned two Mexico-based companies it ties to his associates, saying the network of “Prometheus” is “based in Mexico and Venezuela.”
Captured abroad, arraigned in Nebraska
According to the Justice Department’s Oct. 2 release, Canelon Aguirre, 50, also known as “The Engineer,” was apprehended after a Homeland Security Task Force investigation and appeared before U.S. Magistrate Judge Michael D. Nelson. He was indicted in December 2025 on four conspiracy counts: bank fraud, bank burglary and computer fraud, money laundering, and providing material support to terrorists. He remains detained pending trial. The FBI added him to the Ten Most Wanted list in March 2026.
The FBI’s Omaha office described it as an “overseas capture.” La Opinión reported he was captured in Venezuela and then transferred to the United States; the Justice Department release does not say where he was caught.
The malware: ‘Ploutus’ and $40.73 million
Prosecutors allege he developed “Ploutus” malware, which forces ATMs to spit out cash without debiting any account, a tactic known as jackpotting. The Justice Department says the conspiracy hit machines in 47 states and the District of Columbia, and that 120 defendants have been charged in the District of Nebraska. Infobae, citing the case, reported attacks in Nebraska City (about $19,000, Oct. 6, 2024) and Omaha (about $29,280, Dec. 4, 2024).
Treasury said that, as of August 2025, reported U.S. losses from alleged jackpotting attacks totaled $40.73 million across more than 1,500 attacks, and that the network uses cryptocurrency to launder the proceeds.
The Mexico link: two sanctioned companies
On Sept. 30, Treasury’s Office of Foreign Assets Control designated Canelon Aguirre and seven associates it says are also indicted in Nebraska. It also sanctioned Enigma Community, S. de R.L. de C.V., which it says is owned by Oscar Leonardo Martinez Pirona, and Soluciones Integrales Toluca, S.A. de C.V., which it says is owned by Alejandro Mejia Castillo. Treasury did not describe what either company does. The Justice Department says three co-defendants in the broader Nebraska case have already been sentenced to 78 to 96 months; the charges against Canelon Aguirre remain allegations.
For background on the gang, see our Tren de Aragua profile.
Sources
- U.S. Department of Justice, “Apprehended Venezuelan Tren de Aragua Leader on FBI’s 10 Most Wanted Fugitives List Appears in Nebraska Court,” Oct. 2, 2026
- U.S. Treasury, “Treasury Sanctions Financial Network of Foreign Terrorist Organization, Tren de Aragua, After Theft of Millions from U.S. Banks,” Sept. 30, 2026
- Infobae, “Cae en EEUU ‘Prometeo’, presunto líder financiero del Tren de Aragua vinculado con empresas en México,” Oct. 3, 2026
- La Opinión, “Comparece en EE.UU. ‘Prometeo’, líder del Tren de Aragua capturado en Venezuela,” Oct. 3, 2026
- Photos: FBI and U.S. Department of Justice (public domain), via U.S. Treasury
Reported Oct. 3, 2026, from U.S. government releases and the outlets above. Canelon Aguirre has pleaded not guilty and is presumed innocent; no trial date had been announced.