# FBI adds ATM jackpotting malware developer to Most Wanted

Published: 2026-03-13 · Severity: medium · Sectors: financial-services
Canonical: https://vorant.io/reports/4b7fc2d2-e399-4748-a444-93304caa1a8d/fbi-adds-atm-jackpotting-malware-developer-to-most-wanted

> FBI seeks Venezuelan cybercriminal Anibal Canelon Aguirre for leading ATM jackpotting conspiracy that has stolen $55M+ from U.S. financial institutions to fund Tren de Aragua gang.

The FBI has added Anibal Alexander Canelon Aguirre to its Ten Most Wanted Fugitives list, marking the first cybercrime-focused addition to the list. Canelon Aguirre is accused of leading an international ATM jackpotting operation that has targeted over 1,800 financial institutions across the United States since 2017, resulting in losses exceeding $55 million. He is believed to be the developer of malware used to force unauthorized cash withdrawals from ATMs, continuously modifying the malware to defeat security protections and expand the range of vulnerable machines.

The stolen funds allegedly support the Tren de Aragua (TdA) transnational gang, a designated foreign terrorist organization originating in Venezuela. TdA uses the proceeds to fund drug trafficking, human trafficking, weapons trafficking, and violent crimes across Latin America and the United States. Federal charges filed in December 2025 include conspiracy to commit bank fraud, bank burglary, intentional damage to protected computer systems, money laundering, and providing material support to terrorists.

Canelon Aguirre, 49, has evaded law enforcement since 2017 and has ties to Venezuela and Mexico. The FBI is offering a $1 million reward for information leading to his capture. The investigation is being conducted as part of Joint Task Force Vulcan in partnership with the DOJ Computer Crime and Intellectual Property Section, the U.S. Attorney's Office in Nebraska, and local law enforcement agencies.

## Mentioned in this report

- Threat actors: Anibal Alexander Canelon Aguirre
- Malware: ATM Jackpotting Malware

Source reporting: https://www.fbi.gov/news/stories/anibal-alexander-canelon-aguirre-added-to-fbis-ten-most-wanted-fugitives-list

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/4b7fc2d2-e399-4748-a444-93304caa1a8d/fbi-adds-atm-jackpotting-malware-developer-to-most-wanted.
Full IOC sets, deployable detections, the entity graph, TAXII 2.1 feed and real-time alerts: https://vorant.io/signup