Monitor this situation.

Unsubscribe anytime.

[SITUATION] · [QUIET] · [CRIME]

5 clusters · 55 sources · 47 days · First seen 2 months ago · Last updated 23 days ago

Tren de Aragua ATM jackpotting conspiracy investigation

Overview

Investigations into an international ATM jackpotting conspiracy have led to significant legal actions and the capture of a high-profile fugitive. In August 2026, Juan Manuel Gouveia-Aguilera, a Venezuelan citizen, was sentenced to eight years in a U.S. federal prison for his role in a scheme that used malicious software to steal over $3.5 million. Authorities suggested the network might be linked to the Tren de Aragua, a group designated by the U.S. as a foreign terrorist organization.

By September 2026, the FBI announced the capture of Aníbal Alexander Canelón Aguirre, known as ‘El Ingeniero’ or ‘Prometeo,’ in Venezuela. Identified as the agency’s first ‘cyber fugitive,’ Canelón Aguirre is accused of leading the international conspiracy to steal millions through ATM jackpotting to finance Tren de Aragua. FBI Director Kash Patel described the arrest as a milestone, noting it marked the capture of the final individual on the FBI’s ten most wanted fugitives list.

Following his arrest, Canelón Aguirre was transferred to the United States after being apprehended by the U.S. Coast Guard in international waters. On October 2, 2026, he appeared before a federal court in Nebraska, where he pleaded not guilty to charges including bank fraud conspiracy, money laundering, bank robbery conspiracy, and providing material support to terrorists. Prosecutors allege the conspiracy utilized a specific custom malware called ‘Ploutus’ to force machines to dispense cash while evading forensic analysis. The operation reportedly spanned 47 U.S. states, the District of Columbia, and several other countries.

As of October 10, 2026, Canelón Aguirre remains in custody pending trial. In addition to his criminal charges, the U.S. Department of the Treasury has recently imposed sanctions against him. The ‘Ploutus’ malware used in the attacks was specifically designed to self-delete from infected systems to evade forensic detection.

Entities

FBI · Tren de Aragua · Aníbal Alexander Canelón Aguirre · U.S. Department of the Treasury · Juan Manuel Gouveia-Aguilera

Claims

What the coverage asserts, and how many sources carry each claim.

[● 25 SOURCES] The FBI has captured all ten individuals on its most wanted list.
[● 8 SOURCES] Canelón Aguirre is the first cybercriminal to be included on the FBI's ten most wanted list.
[● 26 SOURCES] Aníbal Alexander Canelón Aguirre was captured in Venezuela.
[● 19 SOURCES] The suspect led an international conspiracy using ATM jackpotting to steal millions of dollars.
[● 19 SOURCES] Funds from the fraud were allegedly used to finance the Tren de Aragua criminal organization.
[● 17 SOURCES] Canelón Aguirre faces charges including bank fraud, bank robbery, money laundering, and providing material support to terrorists.
[● 13 SOURCES] Canelón Aguirre pleaded not guilty to the charges in a Nebraska federal court.
[● 11 SOURCES] The defendant allegedly developed 'Ploutus' malware to facilitate ATM jackpotting attacks.
[● 9 SOURCES] Judge Michael D. Nelson ordered that Canelón Aguirre remain in custody.
[● 6 SOURCES] The ATM jackpotting conspiracy affected financial institutions in 47 U.S. states and Washington, D.C.

Timeline

23 days ago

[CRIME] 2 sources
Aníbal Alexander Canelon Aguirre arrested for Ploutus malware development
Venezuelan national Aníbal Alexander Canelon Aguirre has been arrested for developing Ploutus malware used in ATM jackpotting attacks linked to the Tren de Aragua criminal organization.
27 days ago

[CRIME] 2 sources
Anibal Alexander Canelon Aguirre arrested for ATM malware development
FBI has arrested Anibal Alexander Canelon Aguirre, an alleged Tren de Aragua leader and developer of Ploutus ATM malware, following a high-seas capture. He faces charges of fraud and money laundering.
30 days ago

[CRIME] 20 sources
Aníbal Canelón Aguirre transferred to U.S. to face federal charges
Venezuelan national Aníbal Canelón Aguirre, the FBI's first cyber fugitive, has been transferred to the U.S. to face charges for leading a Tren de Aragua-linked ATM jackpotting scheme.
about 2 months ago

[CRIME] 34 sources
FBI captures final most-wanted fugitive in Venezuela
The FBI has captured its final most-wanted fugitive, Aníbal Alexander Canelón Aguirre, in Venezuela. He is accused of leading a cybercrime ring that used ATM jackpotting to fund the Tren de Aragua gang.
2 months ago

[CRIME] 5 sources
Venezuelan citizen sentenced to eight years for $3.5 million ATM theft
Venezuelan citizen Juan Manuel Gouveia-Aguilera was sentenced to eight years in a U.S. prison for a $3.5 million ATM jackpotting conspiracy linked to Tren de Aragua.

Sources

100percentfedup.com · 2001online.com · abc17news.com · abriendobrecha.tv · actualidad.rt.com · alertas24.com · bajotecho.com.do · caraotadigital.net · combonoticias.com · cubanosporelmundo.com · cybernoz.com · deultimominuto.net · dominicanaaldia.com · dominicanoshoy.com · drvnoticias.com · el-carabobeno.com · elatlantico.do · elclarinweb.com · eldiariony.com · elestimulo.com · elfinanciero.com.mx · elfrente.com.co · elinformadorve.com · elmercurio.com.ec · elnuevodiario.com.do · emisorasunidas.com · entornointeligente.com · hn24.hnonline.sk · infodia.com.ar · infoenn.com · it-daily.net · lahora.gt · lanacionweb.com · laopinion.com · lapatilla.com · larazon.co · localnews8.com · m.n.com.do · montecristinoticias.com · n.com.do · noticiasaldiayalahora.co · notifalcon.com · notitarde.com.ve · occrp.org · orinocotribune.com · primeraedicioncol.com · raidrush.net · rdnvenezuela.com

This summary has been updated 6 times: see revision history