FBI adds ATM jackpotting malware developer to Ten Most Wanted

13 March 2026 high threat financial-services

Anibal Canelon Aguirre, alleged developer of ATM jackpotting malware funding Tren de Aragua gang operations, becomes first cyber fugitive on FBI's Ten Most Wanted list.

The FBI has added Anibal Alexander Canelon Aguirre to its Ten Most Wanted Fugitives list, marking the first time a cybercrime subject has appeared on the list. Canelon Aguirre, 49, is wanted for allegedly leading an international conspiracy that uses ATM jackpotting malware to steal millions from U.S. financial institutions in support of Tren de Aragua (TdA), a Venezuelan transnational gang designated as a foreign terrorist organization. The scheme involves installing malware on ATMs to force unauthorized cash withdrawals, with proceeds flowing through a complex money laundering network to fund TdA's drug trafficking, human trafficking, weapons trafficking, and violent crimes.

Since at least January 2024, the conspiracy has targeted hundreds of financial institutions. Investigators believe Canelon Aguirre developed the malware and continuously modifies it to defeat ATM protections while expanding the range of vulnerable machines. Since ATM jackpotting began in the U.S. around 2017, over 1,800 incidents have been reported with losses exceeding $55 million. Canelon Aguirre has evaded law enforcement since 2017 and is believed to have ties to Venezuela and Mexico.

A federal arrest warrant was issued in December 2025 charging Canelon Aguirre with conspiracy to commit bank fraud, bank burglary and intentionally damage protected computer systems, money laundering, and providing material support to terrorists. The FBI is offering a $1 million reward for information leading to his capture. The investigation is being conducted as part of Joint Task Force Vulcan in partnership with the DOJ Computer Crime and Intellectual Property Section, the U.S. Attorney's Office in Nebraska, and local law enforcement including the Papillion Police Department.

Mentioned in this report

Threat actors Anibal Alexander Canelon Aguirre

Malware ATM Jackpotting Malware

Source reporting: https://www.fbi.gov/news/stories/anibal-alexander-canelon-aguirre-added-to-fbis-ten-most-wanted-fugitives-list

This is the public brief

Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.

Start free