17 Iranians charged in cyber theft campaign
The Department of Justice has charged 17 Iranian nationals over an alleged large-scale cyber theft operation that targeted U.S. universities and government agencies. Reporter Alexandria Hoff examines how the hackers reportedly breached networks and stole intellectual property beginning in 2013.
A Venezuelan man accused of leading a Tren de Aragua operation—and the first cyber fugitive ever placed on the FBI’s Ten Most Wanted list—has returned to the United States after being captured overseas last month.
Anibal Alexander Canelon Aguirre, 50, who is also known by the aliases “Prometheus” and “The Engineer,” appeared in a Nebraska courtroom Friday to face charges related to an alleged multimillion-dollar ATM “jackpotting” scheme.
During his initial court hearing, Aguirre pleaded not guilty to four federal conspiracy charges. He will remain in custody in Nebraska as he awaits trial, according to the Department of Justice (DOJ).
FBI Director Kash Patel described Aguirre’s return as the 10th capture of an individual on the Ten Most Wanted list since the start of the Trump administration. Aguirre is also the first cyber fugitive to have been placed on the list.
Anibal Alexander Canelon Aguirre, an alleged Tren de Aragua leader and the first cyber fugitive placed on the FBI’s Ten Most Wanted list, was captured in Venezuela and brought back to the United States to face federal charges. (FBI)
“Now he’s back in the United States to face justice,” Patel said. “This FBI is running on supercharged horsepower — and there is nowhere on this planet criminals can hide.”
Patel said the 10 captures represent more than two and a half times the number recorded over the previous four years.
Aguirre was arrested in Venezuela last month. Patel later told lawmakers that the FBI had captured one of the country’s most wanted fugitives.
The FBI previously told News Media that Aguirre headed “a large international conspiracy to steal millions of dollars from financial institutions in support of the Tren de Aragua, through an ATM jackpotting scheme since at least 2024.”
Anibal Alexander Canelon Aguirre, also known as “Prometheus,” is shown in an FBI mug shot after being charged in an alleged ATM jackpotting operation tied to Tren de Aragua. (FBI)
An ATM “jackpotting” attack is a form of cybercrime in which criminals exploit weaknesses in an automated teller machine, sometimes using malware, to force it to release cash, according to the DOJ.
Prosecutors allege that Canelon Aguirre created malicious software and served as one of the leaders of the ATM jackpotting conspiracy.
The DOJ said the wider ATM jackpotting operation has been connected to Tren de Aragua, which the United States has designated as a foreign terrorist organization.
Attorney General Todd Blanche said the DOJ has charged nearly 350 alleged Tren de Aragua members and associates since the group received that designation.
“The capture and arrest of Anibal Alexander Canelon Aguirre marks yet another success for the Homeland Security Task Force and Joint Task Force Vulcan,” Blanche said.
“We will continue to break up narcoterrorist finance networks, prosecute violent criminals, and keep American neighborhoods safe.”
Aguirre is charged with four conspiracy offenses involving bank fraud, bank burglary and computer fraud, money laundering, and providing material support to terrorists.
According to the DOJ, the bank fraud conspiracy charge carries the stiffest potential sentence—up to 30 years in federal prison.
Anibal Alexander Canelon Aguirre’s FBI Ten Most Wanted profile (FBI Media)