司法 · ATM“吐钞”

网络犯罪逃犯在海上被捕；内布拉斯加州ATM盗窃案仍待证实

阿尼巴尔·亚历山大·卡内隆·阿吉雷在表示不认罪后，仍被羁押在内布拉斯加州。检方指称他提供了用于盗窃ATM现金的恶意软件，但抓捕细节和财务核算仍不完整。

播出 文字 阅读需 8 分钟32 个来源HeyDay News Desk · About usWatch report
与 HeyDex 一起探索

通过 RSS 关注

原语言视频

文字实录 · 正在加载

译自英文原文。

新闻追踪第 3 天

1 篇报道25 家媒体32 个来源1 个视频

  • 暂无标注日期的事件
  1. 第 1 次更新网络犯罪逃犯在海上被捕；内布拉斯加州ATM盗窃案仍待证实当前位置

海岸警卫队已抓获FBI首名网络犯罪“十大通缉逃犯”，但将他收押并未了结此案，甚至也未能厘清被指盗窃金额的不同估算。阿尼巴尔·亚历山大·卡内隆·阿吉雷目前被羁押在内布拉斯加州，等待审判。他对涉及一项涉嫌与阿拉瓜火车帮有关联的ATM“吐钞”行动的指控表示不认罪。1 4 5

确凿的进展是，一名被告已出现在法庭上。卡内隆·阿吉雷于2026年10月2日星期五在内布拉斯加州出席联邦治安法官庭审，当天司法部公开宣布他已被抓获。官员称，美国海岸警卫队在海上抓获他，并将他带到美国。10月2日并非已经确认的抓捕日期。1 2 4

他现年50岁，也被称为“普罗米修斯”和“工程师”。检方指称，他开发了可使ATM按指令吐出现金的恶意软件，并在软件安装后远程指挥犯罪活动。这一指控将他置于收取现金的作案团伙之上游：他并非只是在某一台ATM前参与作案，而是涉嫌提供并指挥实施盗窃的手段。不过，这一角色仍未得到证明。1 2

甚至抓捕地点也需要谨慎看待。《新闻周刊》和CRBC News称，他是在委内瑞拉被抓获；NewsNation则称，他是在内布拉斯加州被捕。这些说法尚未得到协调。内布拉斯加州已确认是审理地点，但不能因此将其说成海岸警卫队在海上抓获他的地点。具体海域、船只、拦截情形、抓捕日期和移交路线均未得到确认。6 15 11

卡内隆·阿吉雷于2026年3月被列入“十大通缉逃犯”名单，成为该名单上的首名网络犯罪逃犯。WOWT于3月12日报道称，他于当周四被列入名单；而3月17日的一篇转载则使用了“今天”一词。现有材料无法确切确定列入名单的日期。3月的报道说他49岁，这与10月公告所称的50岁未必矛盾。12 25 20 2

针对实体现金的软件

这里的“吐钞”是指恶意软件使ATM按指令吐出现金。这是一项针对实体目标的网络犯罪指控：目标是机器里的钱。现有证据无法证明普通客户的账户或密码遭到泄露，也未指出涉案恶意软件的具体种类、作案团伙如何安装软件，或其通信系统和精确吐钞机制。1 26

对联邦指控的概述涵盖银行欺诈、洗钱、欺诈相关罪名及实质性支持。这些概述并非逐项列明起诉书中的指控。可查阅的法院文件节选只有部分案名页和被告姓名，并不包含完整的指控页；具体指控项数、适用法条、起诉书日期及可能刑期均未得到核实。1 3 4 8

公告中提到的检察官是内布拉斯加州联邦检察官莱斯利·A·伍兹；司法部的官方简介确认了她的姓名拼写。官员称，一名法官下令将卡内隆·阿吉雷羁押候审，但完整的认罪程序记录和羁押令无法供人独立查阅。因此，羁押的具体理由尚未得到核实。被羁押不等于被认定有罪。1 28

这项名为“宙斯复仇行动”（Operation Zeus’s Revenge）的更广泛调查由FBI、国土安全调查局和联合特遣部队“瓦肯”（Joint Task Force Vulcan）参与。官员称，内布拉斯加州已有超过120人因与这些犯罪有关而被起诉。这是起诉人数，并非定罪人数；也不能据此认定所有这些人都出现在卡内隆·阿吉雷本人的起诉书中。海岸警卫队的抓捕工作与调查和起诉是不同的环节。1

资金数额无法吻合

关键事实

  1. 超过120人因内布拉斯加州相关犯罪被起诉的人数 1
  2. 约540万美元HSI估算的调查所涉共谋损失 1
  3. 约140万美元估算的未遂损失，并非已完成的盗窃 1
  4. 约6100万美元自2021年以来更广泛估算的银行盗窃金额 1

这些财务说法描述了巨额的涉嫌损害，但并不能汇总成一个明确的总数。在FBI奥马哈新闻发布会上，国土安全调查局（HSI）估算，与正在调查的ATM“吐钞”共谋案相关的损失约为540万美元，另有约140万美元的未遂损失。未遂损失并不等于已确认被盗的现金。1

官员还提到一项更广泛的估算：自2021年以来，美国银行被盗金额约为6100万美元。现有说法并未厘清540万美元和6100万美元这两项估算背后的统计时期、事件清单或具体涵盖范围。二者既不应相加，也不应视为可以互换的数字。两项估算都无法证明卡内隆·阿吉雷个人收到了多少款项。1

这一区分对涉嫌给组织带来的利益尤其重要。据称，更广泛估算的犯罪所得中约有一半可供阿拉瓜火车帮使用。“可供使用”并不能证明有文件记录的款项转给了其领导人、该组织实际收到了钱，或款项被用于某项具体活动。不能把“实质性支持”的指控当作证明存在融资安排的依据。1

无须夸大数字，也能看出这起案件的现实影响：据称，作案行动从服务银行客户的机器中取走现金，并使金融机构面临重大损失。但没有经核实的总数能够确定受影响的银行或ATM数量、追回的金额或已支付的赔偿。损失估算也不能证明这些损失由储户个人承担。

案件减少不等于定罪

官员称ATM“吐钞”袭击有所减少。一名未具名的FBI奥马哈官员对内布拉斯加州的情况作了更进一步的表述，称自卡内隆·阿吉雷被起诉以来，该州未发生过成功的作案尝试。这比“尝试已经停止”“全国范围的袭击已经结束”或“袭击减少是他被抓获所致”等说法更为有限。起诉日期、观察时段和作为依据的事件记录均未得到确认。1

起诉、抓获和出庭是彼此独立的事件。若官员称改善始于起诉，就不能自动将其归功于之后的抓获。公告报告了袭击活动的变化，但没有独立证明两者存在因果关系。

接下来的关键步骤，是通过法律程序检验有关远程指挥、盗窃总额和组织融资的指控。目前尚未核实下一次庭审或审判日期。卡内隆·阿吉雷仍被羁押，等待审判；目前尚未确认他被定罪、被最终判刑、存在已证实的犯罪所得转移，或被盗款项已得到核实并追回。此次抓获结束了追捕，却没有完成举证。1 4

来源

FBI：宣布卡内隆·阿吉雷被捕的奥马哈新闻发布会。1

司法部：10月2日宣布抓获及其在内布拉斯加州出庭。2

CourtListener：部分起诉书文件。3

Court Cast：在内布拉斯加州出庭及表示不认罪。4

福克斯新闻：网络犯罪逃犯被押回美国及内布拉斯加州指控。5

《新闻周刊》：首名网络犯罪“十大通缉逃犯”被抓获。6

《北普拉特公报》：涉嫌组织ATM“吐钞”行动者在内布拉斯加州面临起诉。7

PACERMonitor：起诉书文件节选。8

《哥伦布电讯报》：ATM计划嫌疑人在内布拉斯加州出庭。9

CRBC News：被控制作恶意软件者表示不认罪。10

NewsNation：司法部宣布抓获。11

WOWT：10月2日逮捕报道及更广泛的损失估算。12

合众国际社：被控制作ATM恶意软件者在美国法院出庭。13

Traders Union：涉嫌网络行动人员在内布拉斯加州案件中被抓获。14

CRBC News：逃犯被押回美国。15

KETV：内布拉斯加州ATM“吐钞”调查中的逮捕行动。16

《里约时报》：在内布拉斯加州表示不认罪。17

Ground News：关于内布拉斯加州ATM盗窃案逮捕行动的汇总报道。18

PublicNow：转载内布拉斯加州联邦检察官办公室的抓获公告。19

Ottumwa Radio：转载3月“十大通缉逃犯”公告。20

Nebraska.tv：当局追捕涉嫌组织国际ATM恶意软件行动者。21

LinkedIn：宣布其被列入“十大通缉逃犯”名单。22

Texas Border Business：关于列入“十大通缉逃犯”名单的报道。23

福克斯新闻：首名被列入逃犯名单的网络犯罪嫌疑人。24

WOWT：3月12日列入名单的报道。25

PressReleaseCloud：通缉国际ATM“吐钞”案嫌疑人的公告。26

PublicNow：转载司法部抓获公告。27

司法部：莱斯利·A·伍兹的官方简介。28

司法部：内布拉斯加联邦地区检察官办公室网站。29

PublicNow：伍兹获任顾问委员会成员的公告。30

《内布拉斯加观察家报》：参议院确认内布拉斯加州联邦检察官人选。31

《奥马哈世界先驱报》：莱斯利·伍兹获确认任职的报道。32

播出原貌 12 行
  1. The Coast Guard captured the FBI’s first cybercrime Ten Most Wanted fugitive at sea. The wider prosecution involves more than 120 people charged in Nebraska and millions in estimated bank losses. What does his capture establish—and what remains unproved about the thefts and alleged gang financing?
  2. Anibal Alexander Canelon Aguirre is now in federal custody in Nebraska. He is 50, also known as Prometheus and The Engineer, and accused of developing malware and remotely directing thefts from cash machines. A federal judge ordered him detained pending trial. That detention is not a conviction, and his alleged connection to Tren de Aragua remains unproven.
  3. Canelon Aguirre pleaded not guilty before a federal magistrate judge on Friday, October second, 2026. That is the established court-appearance date and the date of the public apprehension announcement—not a verified capture date. Nebraska U.S. Attorney Lesley A. Woods is the prosecutor identified with the announcement. The complete plea minutes and detention order have not been independently examined, and the detailed grounds for detention are not verified.
  4. The Coast Guard apprehension happened at sea; the court appearance happened in Nebraska. Those are different events. The location descriptions conflict: some place the capture in Venezuela, while another places an arrest in Nebraska. That discrepancy remains unresolved. The exact maritime location, capture date, vessel, interception circumstances and transfer route are not established. Nebraska’s confirmed role as the court venue cannot be substituted for the location of the apprehension.
  5. Canelon Aguirre entered the Ten Most Wanted Fugitives list in March 2026, as its first cybercrime fugitive. The exact listing day remains uncertain: contemporary coverage dated March twelfth described his addition that Thursday, while a March seventeenth republication used the word today. His age was given as 49 in March and 50 in October; those ages at different times are not necessarily contradictory.
  6. The alleged malware made ATMs dispense cash on command. That is what jackpotting means in this case. Canelon Aguirre’s accused role sits upstream of the people collecting the money: developing the software, then remotely directing crimes after installation. It is not simply an accusation that he took cash from one machine. The malware’s name, installation method, communications system and precise technical dispensing mechanism are not established. The described target was cash inside ATMs; no established finding shows that ordinary customers’ accounts or passwords were compromised.
  7. Canelon Aguirre faces numerous federal charges in the District of Nebraska. The available charge descriptions encompass bank fraud, money laundering, fraud offenses and material support. The indictment’s complete charging pages have not been independently examined, so the exact counts, statutes, indictment date and potential sentence are not verified. A material-support allegation does not itself prove that he financed the organization. Its correct name is Tren de Aragua, abbreviated TDA.
  8. More than 120 people had been charged in Nebraska in connection with the crimes by the announcement. That measures the scale of the prosecution, not the number convicted, and it does not establish that everyone appears in Canelon Aguirre’s own indictment. The investigation is called Operation Zeus’s Revenge. The FBI, Homeland Security Investigations and Joint Task Force Vulcan are among the enforcement bodies associated with it. Their investigative roles are distinct from the Coast Guard’s apprehension, and their involvement does not establish any individual defendant’s guilt.
  9. The investigated ATM-jackpotting conspiracy carries an estimated five-point-four million dollars in losses, plus approximately one-point-four million in attempted losses. Attempted losses are not money established as stolen. A separate, broader estimate puts money taken from American banks since 2021 at approximately 61 million dollars. The smaller and larger estimates have unreconciled accounting periods, incident inventories and precise coverage. They must not be added together or treated as interchangeable, and neither figure establishes how much Canelon Aguirre personally received.
  10. Approximately half of those broader estimated proceeds was allegedly available for TDA’s use. Available is not the same as a documented transfer to its leaders, money actually received, or spending on a particular activity. The amounts remain investigative estimates, and the proposed organizational benefit remains an allegation. The practical stakes are cash removed from machines serving bank customers and substantial exposure for financial institutions. No verified totals establish the number of affected ATMs or banks, money recovered, or restitution paid. Nor do the loss estimates establish that depositors personally bore those losses.
  11. Nebraska has a reported record of no successful jackpotting attempt since Canelon Aguirre was charged. Attacks were also described as declining. But no successful attempt is narrower than no attempts at all, and a Nebraska observation does not establish that attacks ended nationwide. The charging date, observation interval and underlying incident record are not established. Charging, capture and court appearance are separate events: an improvement described as beginning at charging cannot automatically be credited to his later apprehension.
  12. The capture establishes custody and brings Canelon Aguirre before the court that will test the case. It does not establish guilt, the alleged remote direction, the theft totals or a financing arrangement with TDA. No proven proceeds transfer or verified recovery of the missing money has been established. He remains detained pending trial, and no verified next-hearing or trial date is available.

来源

32 个来源25 家媒体1 个视频

来源地图

追溯本篇报道的依据。图谱展示其关联；下方链接可打开本文引用的来源。

来源图谱将在您阅读时加载。

探索完整的新闻编辑室图谱 ↗

译文更新于

修订记录

  1. r1首次发布。