A notorious cybercrime leader from Venezuela’s Tren de Aragua cartel has been arrested and arraigned by US authorities for his role in a massive “jackpotting” scheme that compromised ATMs with malware and dispensed tens of thousands of dollars in cash. Anibal Alexander Canelon Aguirre, also known as “Prometheus” and “The Engineer,” is the first cybercriminal to ever make the FBI’s “10 Most Wanted Fugitives” list.
Canelon Aguirre is a key figure in the Tren de Aragua cartel, which has evolved from a prison gang into a multinational criminal enterprise involved in various illicit activities, including drug trafficking, kidnapping, and human trafficking. The group has increasingly turned to cybercrime as a convenient and stealthy way of amassing capital to fund its operations. According to experts, Canelon Aguirre was the mastermind behind the Ploutus-D malware used to compromise ATMs in several countries.
The “jackpotting” scheme involved physically implanting malware into cash machines, allowing the attackers to remotely control the devices and dispense thousands of dollars to money mules. The stolen funds were then laundered through cryptocurrency networks, including TRON, a decentralized finance trading platform. The US Department of the Treasury’s Office of Foreign Assets Control (OFAC) estimates that more than 1,500 jackpotting incidents resulted in $40.7 million stolen as of August 2025.
The Tren de Aragua cartel has been using cryptocurrency to launder its ill-gotten gains, leveraging infrastructure created by criminal organizations in Colombia, Mexico, and Venezuela. This trend is concerning, as it suggests that cybercrime is becoming an increasingly important revenue stream for terrorist organizations and other malicious groups. “Tren de Aragua is using ATM malware as a terrorist financing tool, then moving the cash onto TRON so it looks like ordinary exchange deposits,” said Ari Redbord, global head of policy at blockchain analysis firm TRM Labs.
The arrest of Canelon Aguirre marks a significant victory for US authorities in their efforts to disrupt the Tren de Aragua cartel’s operations. The FBI has been working closely with international partners to dismantle the group’s networks and apprehend its members. “We are going after the entire jackpotting network, from ringleaders and malware developers to crews in the US,” said Eugene Kowel, a special agent in charge with the FBI’s Omaha office.
As the cybercrime landscape continues to evolve, it is essential for financial institutions and individuals to be vigilant against these types of attacks. To avoid falling victim to “jackpotting” schemes, users should ensure that their ATMs are regularly updated with security patches and that they use strong antivirus software to detect and prevent malware infections. Additionally, being cautious when using public Wi-Fi networks or interacting with suspicious emails can help reduce the risk of cybercrime. By staying informed and taking proactive steps to secure their digital lives, individuals can protect themselves against these types of threats.
Source: Dark Reading — 2026-10-08