Anibal Alexander Canelon Aguirre, a 50-year-old Venezuelan national known online as “Prometheus” and “The Engineer,” made his first appearance before a U.S. magistrate judge in Nebraska on October 2, 2026. Prosecutors describe him as the leader of a conspiracy that used Ploutus, malware built to force ATMs to spit out cash, against banks and credit unions in 47 states and the District of Columbia. BleepingComputer reports that he is the alleged developer of the tool itself.
His arrival in a federal courtroom closes a chase that stretched across months and two countries. It began with a federal warrant out of Omaha in December 2025 and, in March 2026, a place on the FBI’s Ten Most Wanted Fugitives list, the first time that list had carried a cybercrime suspect.
Four conspiracy counts and their maximum sentences
The Justice Department’s announcement of the apprehension lists four counts, all of them conspiracy: bank fraud, which carries up to 30 years; bank burglary and fraud in connection with computers, up to five years; money laundering, up to 20 years; and providing material support to terrorists, up to 15 years. A federal grand jury in the District of Nebraska indicted him in December 2025. U.S. Magistrate Judge Michael D. Nelson handled the initial appearance, and Chief U.S. District Judge Brian C. Buescher and Magistrate Judge Ryan C. Carson are presiding over the case. He pleaded not guilty and remains detained pending trial.
Attorney General Todd Blanche called the capture “yet another success for the Homeland Security Task Force and Joint Task Force Vulcan.” Assistant Attorney General A. Tysen Duva said the Criminal Division and its partners will pursue anyone who attacks financial institutions to support foreign terrorist organizations, calling the apprehension a “clear message.” FBI Director Kash Patel credited the bureau’s Cyber Division and Critical Incident Response Group for bringing Canelon Aguirre “back in the United States to face justice.”
The terrorism count follows from the money. The material-support charge reflects the allegation that proceeds were laundered into accounts controlled by Tren de Aragua, the Venezuelan gang the State Department designated a foreign terrorist organization in February 2025.
Ploutus and the cash dispensing module inside an ATM
Ploutus does not break the cash box. The malware talks to the machine’s cash dispensing module and issues unauthorized commands that make it release bills, a technique called jackpotting. In the December 2025 case against 54 other defendants, The Hacker News reported that crews surveilled machines, installed the malware by swapping a hard drive or plugging in a USB drive, deleted evidence afterward and split the cash in predetermined shares.
The Justice Department says the Ploutus files carried anti-analysis measures, including software protection utilities meant to block reverse-engineering and debugging, plus files whose job was to delete the malware and hide the intrusion from bank employees. Those details bear on the “developer” label: a tool built to resist forensic review suggests someone maintained it, though the indictment itself charges a conspiracy rather than a single act of authorship.
The $5.4 million count and a larger loss estimate
BleepingComputer’s account of the court appearance puts the money at more than $5.4 million stolen in 63 jackpottings at banks and 54 at credit unions between February 2024 and December 2025, with another $1,429,738 in attempted attacks. The Justice Department release read for this article carries the 47-state reach but not those dollar figures, so they rest on the outlet’s reporting.
Other tallies run higher because they cover a wider net. In the December 2025 charging announcement, the department cited about $40.73 million lost across 1,529 jackpotting incidents since 2021. Omaha station WOWT, reporting on the arrest, tied Canelon Aguirre’s crimes to roughly $61 million in losses from banks nationwide and quoted the U.S. Attorney for Nebraska saying there has not been a single jackpotting incident in the state since he was charged.
From a Venezuelan capture to Omaha
He did not walk into a courtroom on his own. Euronews reported that Patel announced the capture during a Senate Judiciary Committee hearing on September 16, saying the detainee was already on his way to the United States; the arrest itself took place in Venezuela on September 14 or 15. The FBI’s Ten Most Wanted page now carries a captured banner over a profile that had offered up to $1 million for information leading to his arrest and described him as armed and dangerous.
The case will be tried in Nebraska, where the first Ploutus crews were charged in two 2025 indictments, the first against 32 defendants on October 21 and the second against 22 on December 9. Nebraska prosecutors have so far charged dozens of Tren de Aragua members in the jackpotting scheme, and the most serious count against the man the FBI called “The Engineer” carries up to 30 years in prison.
This article was produced with the assistance of AI and reviewed by Morning Overview editors prior to publication.
More from Morning Overview
- Hurricane Hunter radar shows four warning signs that a tropical cyclone is about to strengthen, a University of Miami study found
- NTSB report details how a family of four died when their plane’s nose suddenly pitched up
- Doctors warn a silent liver disease now affects one in three American adults
- Common allergy, bladder and sleep pills tied to sharply higher dementia odds
