For the first time in the storied history of the FBI’s Ten Most Wanted Fugitives list, a cybercriminal has been added, marking a pivotal shift in how we perceive modern threats. It is a clear signal that today’s most dangerous offenders are as likely to wield malware as they are to brandish firearms.
Introducing Fugitive No. 540, Anibal Aguirre, also known by the alias “Prometheus.” He now stands among the FBI’s most notorious targets. Authorities allege that Aguirre masterminded a sophisticated ATM “jackpotting” operation. This scheme employed custom-designed malware to command cash machines throughout the United States to dispense money, effectively on demand.
However, this isn’t just a case of high-tech theft, according to federal prosecutors. They assert that the illicit operation channels millions of dollars to the Tren de Aragua (TdA), a violent transnational criminal organization based in Venezuela, which U.S. officials categorize as a terrorist entity.
Surveillance footage released by the Justice Department, part of a comprehensive investigation into the ATM jackpotting conspiracy linked to Tren de Aragua, features a masked suspect caught in the act.
“The violent criminals on the FBI’s Top Ten Most Wanted Fugitives list are the worst of the worst, and they are in the FBI’s sights,” stated FBI Director Kash Patel in anticipation of the announcement. His words underscore the agency’s unwavering commitment to tracking down these high-profile offenders.
“The violent criminals on the FBI’s Top Ten Most Wanted Fugitives list are the worst of the worst, and they are in the FBI’s sights,” FBI Director Kash Patel said in a statement ahead of the announcement.
“For more than 75 years, the Ten Most Wanted Fugitives program has been one of the FBI’s most powerful tools for bringing dangerous criminals to justice.”
Patel makes clear the Bureau is counting on the public.
“By sharing information about these fugitives with the public, we greatly expand the reach of our investigations,” he said. “Our message is simple: if you commit violent crimes or prey on innocent people, we will continue pursuing you — and with the public’s help, we will find you.”
Prosecutors in the District of Nebraska have charged 93 defendants in connection with the broader conspiracy. Authorities say many millions of dollars are drained from ATM machines across the country as part of the scheme.
U.S. Attorney Lesley Woods says investigators follow the money trail from compromised American ATMs all the way back to what she describes as the operation’s “terroristic roots in Venezuela.”
Surveillance footage released by the U.S. Attorney’s Office shows an individual allegedly involved in the ATM jackpotting scheme targeting financial institutions across the U.S. (U.S. Attorney’s Office, District of Nebraska)
She says the stolen funds allegedly go to Tren de Aragua leaders “to fund their terroristic activities and purposes,” calling the case a major coordinated effort by state, local and federal law enforcement.
Woods says the investigation exposes the conspiracy “from its lowest levels to the alleged mastermind behind the malware” and removes dozens of TdA members from Nebraska.
“TdA members will find no safe harbor in the State of Nebraska,” she says.
A hooded individual appears to record an ATM during what prosecutors describe as a coordinated jackpotting operation tied to a foreign criminal organization. (U.S. Attorney’s Office, District of Nebraska)
Special Agent in Charge Eugene Kowel of the FBI’s Omaha Field Office said TdA “poses a direct threat to our communities both here in the Midwest and across our country.”
He said the organization relies on a range of criminal operations — including sophisticated cyberattacks on U.S. financial institutions — to bankroll violence and terror.
An ATM is seen open in an image released by federal authorities as part of a sweeping investigation into a cyber-enabled jackpotting conspiracy. (U.S. Attorney’s Office, District of Nebraska)
“As criminal enterprises change tactics, we surge resources and adapt accordingly to protect the American people,” Kowel said.
Homeland Security Investigations Special Agent in Charge Mark Zito called Tren de Aragua “a ruthless terrorist organization that preys on communities, spreads fear, and bankrolls violence across borders.”
A masked individual appears in surveillance footage released by the Justice Department as part of a sweeping investigation into an ATM jackpotting conspiracy tied to Tren de Aragua. (U.S. Attorney’s Office, District of Nebraska)
“We will not tolerate foreign terrorists stealing from our citizens and threatening our homeland,” Zito said. “We will track you down.”
The Ten Most Wanted Fugitives list launched in 1950 and has traditionally featured serial killers, cartel bosses and violent fugitives.
By placing an alleged cyber architect on that list for the first time, the FBI is sending a clear message: digital financial warfare tied to foreign criminal networks now ranks among the most serious threats facing the country.
Authorities believe Aguirre may be in Venezuela and operating outside the United States.
Officials say elevating him to the Ten Most Wanted list is designed to generate international tips and increase pressure on the network behind the operation.
Anyone with information on his whereabouts is urged to contact the FBI.
Stepheny Price covers crime, including missing persons, homicides and migrant crime. Send story tips to stepheny.price@fox.com.
