The FBI is offering a $1 million reward for information leading to the capture of Canelon Aguirre, also known as Prometheus or "The Engineer," who authorities said is the architect of malware that siphoned millions of dollars from credit union and bank ATMs nationwide.
On March 12, federal authorities added Aguirre to its Ten Most Wanted Fugitives list, alleging his leadership in the ATM theft scheme has financially supported the criminal activities of Tren de Aragua (TdA), a transnational criminal organization. Prosecutors said the group orchestrated more than 100 bank and credit union ATM jackpotting attacks in Nebraska and 15 other states resulting in more than $6.1 million in losses. Based in Venezuela, TdA is involved with human, drug and weapons trafficking as well as violent crimes in the U.S. and Latin America.
Aguirre was the first cybercriminal to be placed on the FBI's Ten Most Wanted Fugitives list, according to the federal agency. Although the FBI has a separate "Cyber's Most Wanted" list for digital crimes, Aguirre was the first person from that category to be included in the widely publicized "Ten Most Wanted Fugitives" list.
FBI Omaha Special Agent in Charge Eugene Kowel said Aguirre developed malware that exploits the ATM's applications and bypasses bank authorizations, directing the machines to dispense all of its cash on demand without linking withdrawals to accounts.
"Canelon Aguirre is constantly modifying his malware to defeat protections that financial institutions put on the ATMs and is expanding the range of machines that could be potential targets," Kowel said.
On Dec. 9, a federal arrest warrant was issued for Aguirre after he was charged with conspiracy to commit bank fraud; conspiracy to commit bank burglary and intentionally damage a protected computer system; conspiracy to commit money laundering; and conspiracy to provide material support to terrorists.
A superseding indictment unsealed in December by Nebraska federal prosecutors, alleged 54 individuals carried out the operation using advanced surveillance and burglary tactics to install malware in credit union and bank ATMs to steal and launder money. Since then, three additional indictments have charged more than 35 suspects who also were allegedly involved in the scheme.
Kowel said Aguirre has evaded law enforcement since 2017 when ATM jackpotting incidents began occurring in the U.S. Since then, more than 1,800 jackpotting attacks have been reported nationwide, resulting in $55 million in losses.
"ATM jackpotting attempts happen in our country almost daily, and he is connected to many of these," Kowel said. "He has been on our radar for a while, and we're hoping that bringing attention to him and to his crimes will help us obtain information, ultimately leading to his apprehension and arrest."
Canelon Aguirre is 49 years old and has black and gray hair and brown eyes. He is between 5'5" and 5'7" tall and weighs about 190 pounds.
Anyone with information about Canelon Aguirre is urged to contact the FBI's toll-free tipline at 1-800-CALL-FBI (1-800-225-5324), contact a local FBI office or submit a tip online at tips.fbi.gov.
"We're really hoping this reward will encourage people who may have information about his whereabouts to call us. They can do so anonymously, and they can do so without attribution," Kowel said. "Any information they provide that can help us identify his location and bring him to justice will be rewarded."
Peter Strozniak can be reached at peter.strozniak@arc-network.com.
© Arc, All Rights Reserved. Request academic re-use from www.copyright.com. All other uses, submit a request to TMSalesOperations@arc-network.com. For more information visit Asset & Logo Licensing.