Alleged operation targeted or carried out attacks in 47 states, Washington, D.C., and abroad

Anibal Alexander Canelon Aguirre, a 50-year-old Venezuelan man, pleaded not guilty Friday in a Nebraska federal court to charges he developed malware used to steal millions of dollars from ATMs across the United States in a widespread ATM “jackpotting” operation that prosecutors have linked to the Venezuelan gang Tren de Aragua. Canelon Aguirre, who used the aliases “Prometheus” and “The Engineer,” was captured after the FBI placed him on its Ten Most Wanted Fugitives list in March.

The placement made Canelon Aguirre the first alleged cybercriminal — and the 540th person overall — to be added to the FBI’s Ten Most Wanted Fugitives list. He is accused of being a leader of a widespread ATM jackpotting operation that federal investigators have tied to Tren de Aragua.

Prosecutors said Canelon Aguirre developed a type of malware called Ploutus that was used in the attacks. ATM jackpotting is when hackers use malware to force cash machines to dispense money without taking it from a bank account.

The software included protections meant to make it difficult for investigators to analyze, prosecutors said, and could delete itself from an ATM to hide evidence of the attack.

The Justice Department said the operation targeted or carried out attacks in 47 states, Washington, D.C., and several foreign countries. So far, 120 people have been charged in Nebraska in connection with the alleged scheme.

A federal grand jury indicted Canelon Aguirre in December on charges of conspiracy to commit bank fraud, bank burglary and computer fraud, money laundering, and providing material support to terrorists. The bank fraud count carries a maximum sentence of 30 years in prison.

Federal investigators have tied the operation to Tren de Aragua, a Venezuelan gang the Trump administration has designated a foreign terrorist organization. Authorities said the gang has used ATM jackpotting as another source of revenue alongside crimes that include drug and firearms trafficking, kidnapping, robbery, and extortion.

Canelon Aguirre will remain in federal custody while awaiting trial.