Back to all stories

FBI Adds Alleged Tren de Aragua Cybercriminal to Ten Most Wanted List

The FBI has placed alleged Venezuelan cybercriminal Anibal Aguirre, known online as “Prometheus,” on its Ten Most Wanted Fugitives list for the first time in the program’s 75‑year history for a primarily cyber‑driven crime, signaling how digital attacks are now treated on par with traditional violent offenses. Prosecutors in the District of Nebraska say Aguirre is the architect of a sweeping ATM “jackpotting” scheme that used custom malware to make machines across the United States dispense cash on command, with at least 93 defendants charged in the wider conspiracy. U.S. Attorney Lesley Woods says investigators traced millions of dollars in stolen U.S. funds back to Tren de Aragua, a violent Venezuelan transnational criminal organization that officials describe as a terrorist group, arguing the cyber theft directly bankrolls the gang’s “terroristic activities and purposes.” FBI Director Kash Patel and Omaha Special Agent in Charge Eugene Kowel are appealing to the public for tips, warning that Tren de Aragua poses a direct threat to communities in the Midwest and nationwide through a mix of cyberattacks and traditional violent crime. The case underscores growing concern among law enforcement and security analysts that organized gangs are increasingly using sophisticated financial hacks on U.S. institutions to fund broader criminal and potentially terror‑linked operations.

Cybercrime and Financial Fraud Transnational Gangs and U.S. Law Enforcement

📌 Key Facts

  • Anibal Aguirre, alias “Prometheus,” has been named Fugitive No. 540 on the FBI Ten Most Wanted Fugitives list, the first alleged cybercriminal to be added.
  • Prosecutors in the District of Nebraska have charged 93 defendants in an ATM “jackpotting” conspiracy that used custom malware to drain machines across the U.S.
  • Investigators allege millions stolen from U.S. ATMs were funneled to leaders of Tren de Aragua, a violent Venezuelan transnational criminal organization U.S. officials describe as a terrorist group.

📊 Relevant Data

Tren de Aragua originated in a Venezuelan prison in the early 2010s and has expanded into a transnational criminal organization involved in activities such as human trafficking, extortion, kidnapping, and cybercrimes.

Tren de Aragua - Wikipedia — Wikipedia

Nearly 8 million Venezuelans have fled the country since 2014 due to political strife, human rights abuses, and lack of economic opportunities, with many migrating to the United States.

Venezuela Crisis Explained — UNHCR

The U.S. designated Venezuela for Temporary Protected Status (TPS) in 2021, allowing over 600,000 Venezuelans already in the country to live and work legally, with extensions covering nearly 1 million immigrants from Venezuela and other nations through fall 2026.

Temporary Protected Status — American Immigration Council

In Nebraska, international migration contributed to a 0.65% population increase in 2024, ranking 19th among states, with the foreign-born population growing from 4.3% in earlier years to higher shares driven by immigrants including Venezuelans.

Nebraska, propelled by international migration, surpasses the 2 million population mark — Nebraska Examiner

ATM jackpotting incidents in the U.S. numbered around 700 in 2025, resulting in over $20 million in losses, with malware like the Ploutus family used to force ATMs to dispense cash.

FBI says ATM 'jackpotting' attacks are on the rise, and netting hackers millions in stolen cash — TechCrunch

📰 Source Timeline (1)

Follow how coverage of this story developed over time