FBI adds ATM jackpotting malware developer to Most Wanted
FBI seeks Venezuelan cybercriminal Anibal Canelon Aguirre for leading ATM jackpotting conspiracy that has stolen $55M+ from U.S. financial institutions to fund Tren de Aragua gang.
Sourcefbi.gov — open the original
What to check
- Applies to
- Whether this concerns you is not assessed; the names the report mentions are listed below.
The FBI has added Anibal Alexander Canelon Aguirre to its Ten Most Wanted Fugitives list, marking the first cybercrime-focused addition to the list. Canelon Aguirre is accused of leading an international ATM jackpotting operation that has targeted over 1,800 financial institutions across the United States since 2017, resulting in losses exceeding $55 million. He is believed to be the developer of malware used to force unauthorized cash withdrawals from ATMs, continuously modifying the malware to defeat security protections and expand the range of vulnerable machines.
The stolen funds allegedly support the Tren de Aragua (TdA) transnational gang, a designated foreign terrorist organization originating in Venezuela. TdA uses the proceeds to fund drug trafficking, human trafficking, weapons trafficking, and violent crimes across Latin America and the United States. Federal charges filed in December 2025 include conspiracy to commit bank fraud, bank burglary, intentional damage to protected computer systems, money laundering, and providing material support to terrorists.
Canelon Aguirre, 49, has evaded law enforcement since 2017 and has ties to Venezuela and Mexico. The FBI is offering a $1 million reward for information leading to his capture. The investigation is being conducted as part of Joint Task Force Vulcan in partnership with the DOJ Computer Crime and Intellectual Property Section, the U.S. Attorney's Office in Nebraska, and local law enforcement agencies.
Mentioned in this report
Source reporting: https://www.fbi.gov/news/stories/anibal-alexander-canelon-aguirre-added-to-fbis-ten-most-wanted-fugitives-list
Free public brief. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them, no card.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries live profiles of the actors and malware it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,436 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs