The US Blacklists Alleged Venezuelan Cyber Crime Mastermind | #cybercrime | #infosec

The U.S. Department of the Treasury on Wednesday announced it had placed on a special blacklist Aníbal Alexander Canelón Aguirre— a Venezuelan who appears on the FBI’s “Ten Most Wanted” list—identifying him as a key link in a financial network for the notorious crime group Tren de Aragua. 

Canelón Aguirre is wanted by the Justice Department for allegedly leading a multi-million dollar ATM fraud scheme. Authorities accuse him of masterminding a jackpotting operation involving malware that when installed allows thieves to direct the bank machine to spew out money.

The alleged Venezuelan hacker topped a list of six Venezuelans and three Mexicans whose names were announced Wednesday as having been added to a group of specially designated nationals. It effectively locks them out of the global financial system. Six of the named are co-defendants of Canelón Aguirre in a U.S. prosecution.

The accused hacker has been on the run, lending his tech skills to the likes of a Romanian mafia operating along Mexico’s white-sand beaches and became the cyber “engineer” of the infamous Venezuelan Tren de Aragua gang. 

Appearing before the Senate Judiciary Committee two weeks ago, the FBI Director Kash Patel announced that federal authorities had apprehended a long-sought fugitive, claiming the arrest effectively cleared the agency’s 10 Most Wanted Fugitives list.

“Just this past weekend, we captured a thug down in Venezuela who is on our most wanted list and on the run for years. He has been captured, apprehended, and is on his way back to the United States of America. That’s ten of ten,” Patel told lawmakers.

Patel did not formally identify the suspect or provide operational details, offering no information on how the operation was carried out and whether Venezuelan authorities assisted. He only said that the arrested person was en route to the United States to face prosecution.

OCCRP reached out the Venezuelan government for comment but did not get a response.

An FBI spokesman declined to elaborate on the director’s remarks and as of Wednesday afternoon Canelón Aguirre, 49, remains on the agency’s website for the current 10 Most Wanted Fugitives. 

He was added to the list on March 12, 2026, becoming the first alleged cybercriminal ever to appear on it. The agency was offering up to a million dollars for information leading directly to his arrest and described him as armed and dangerous.

Known as “El Ingeniero,” “Prometeo” or “Prometheus,” Canelón Aguirre is accused by the FBI of being the alleged creator of a malware tied to Tren de Aragua (TdA), a Venezuelan gang that has spread to half a dozen South American countries after emerging from a Venezuelan prison around 2012. 

The scheme allowed a network to loot millions of dollars from ATMs across several U.S. states starting at least in January 2024. The technique is known as jackpotting: malicious software takes control of the ATM and forces it to dispense all the cash it holds.

“Within TdA, the jackpotting proceeds would then be transferred among members and associates of the organization in an effort to conceal the fact that they are illegally obtained proceeds,”  according to the indictment of Canelon and colleagues.

Prosecutors claim that the proceeds were then moved through a money-laundering network tied to Tren de Aragua, an organization Washington has designated a foreign terrorist group. U.S. authorities describe the structure as combining high-level cybercrime with financing for a transnational criminal organization. OCCRP was among the first to warn of the nascent criminal organization spreading into the U.S. in its November 2023 series Narcofiles: The New Criminal Order. 

The arrest warrant against Canelón Aguirre was issued in Omaha on December 9, 2025, in the U.S. District Court for the District of Nebraska, as part of a case that already includes dozens of defendants. He was charged with conspiracy to commit bank fraud, conspiracy to commit bank burglary and intentionally damage a protected computer system as well as to commit money laundering and provide material support to a foreign terrorist organization.

Also charged in the same indictment is Jimena Romina Araya Navarro, known in Venezuela as “Rosita” from a Venezuelan comedy show, who is accused of playing a role in the 2012 prison break of the leader of the Tren de Aragua, Héctor Rusthenford Guerrero Flore. His alias is “Niño Guerrero,” and he escaped from the notorious Tocorón prison. The broader jackpotting case now totals 87 defendants nationwide across the United States. Araya Navarro was not among those placed under the Treasury blacklisting.

Before becoming Tren de Aragua’s “engineer,” Canelón Aguirre had already been flagged in connection with a different kind of criminal structure. According to an intelligence brief from Mexico’s Security Cabinet (Gabinete de Seguridad), dated October 30, 2020, and a report from Mexico’s Financial Intelligence Unit (UIF) on Romanian criminal groups, Canelón was identified as the developer of the malware known as Ploutus.D. 

This software, the intelligence brief suggested, was used by the organization known as the Riviera Maya Gang, led by Romanian national Florian Tudor, alias “El Tiburón” (“The Shark”), to empty ATMs in the tourist zone of Quintana Roo, which includes Cancún, and in the United States.