[REVISION HISTORY]

Tren de Aragua ATM jackpotting conspiracy investigation

6 recorded revisions of this situation.

What changed

2026-10-06 19:52 UTC → 2026-10-10 07:52 UTC · added ~~removed~~

Investigations into an international ATM jackpotting conspiracy have led to significant legal actions and the capture of a high-profile fugitive. In August 2026, Juan Manuel Gouveia-Aguilera, a Venezuelan citizen, was sentenced to eight years in a U.S. federal prison for his role in a scheme that used malicious software to steal over $3.5 million. Authorities suggested the network might be linked to the Tren de Aragua, a group designated by the U.S. as a foreign terrorist organization. By September 2026, the FBI announced the capture of Aníbal Alexander Canelón Aguirre, known as ‘El Ingeniero’ or ‘Prometeo,’ in Venezuela. Identified as the agency’s first ‘cyber fugitive,’ Canelón Aguirre is accused of leading the international conspiracy to steal millions through ATM jackpotting to finance Tren de Aragua. FBI Director Kash Patel described the arrest as a milestone, noting it marked the capture of the final individual on the FBI’s ten most wanted fugitives list. Following his arrest, Canelón Aguirre was transferred to the United States after being apprehended by the U.S. Coast Guard in international waters. On October 2, 2026, he appeared before a federal court in Nebraska, where he pleaded not guilty to charges including bank fraud conspiracy, money laundering, bank robbery conspiracy, and providing material support to terrorists. Prosecutors allege the conspiracy utilized a specific custom malware called ‘Ploutus’ to force machines to dispense cash while evading forensic analysis. The operation reportedly spanned 47 U.S. states, the District of Columbia, and several other countries. ~~A federal judge has ordered~~ As of October 10, 2026, Canelón Aguirre ~~to remain~~ remains in custody ~~while legal proceedings continue, describing~~ pending trial. In addition to his criminal charges, the ~~upcoming prosecution as a complex matter.~~ U.S. Department of the Treasury has recently imposed sanctions against him. The ‘Ploutus’ malware used in the attacks was specifically designed to self-delete from infected systems to evade forensic detection.

Versions

Select a version to see what changed compared to the one before it.