US sanctions Tren de Aragua gang members in ATM hacks crackdown
Treasury sanctioned eight Tren de Aragua members over ATM jackpotting that stole about $40.7 million.
The U.S. Treasury sanctioned eight members of the Venezuelan gang Tren de Aragua for ATM jackpotting that targeted U.S. banks and credit unions. OFAC says Anibal Alexander Canelon Aguirre, also known as Prometheus, developed the Ploutus malware and that the network, based in Mexico and Venezuela, forced ATMs to dispense cash and laundered the proceeds. OFAC estimates members stole $40.73 million across more than 1,500 attacks as of August 2025, and the Justice Department has charged 98 linked suspects since October 2025. Treasury also listed seven TRON addresses that TRM Labs says received about $6.1 million.
- OFAC sanctioned eight Tren de Aragua members, including alleged Ploutus developer Aguirre.
- OFAC estimates $40.73 million stolen in more than 1,500 U.S. ATM jackpotting attacks.
- Justice Department has charged 98 suspects since October 2025.
- Seven TRON addresses that received about $6.1 million were also designated.
- TdA was designated a transnational criminal organization and later a foreign terrorist organization.
Full article488 words · extracted from bleepingcomputer.com · click to collapse
The U.S. Treasury Department has sanctioned eight members of the Venezuelan gang Tren de Aragua (TdA) for their role in the theft of millions of dollars in ATM jackpotting attacks across the United States.
In jackpotting attacks, criminals deploy malware (e.g., ATMii, ATMitch, GreenDispenser, Alice, RIPPER, Skimer, SUCEFUL, and Ploutus) on bank and credit union automated teller machines (ATMs), which allows them to empty the ATMs of cash and delete evidence via an attached USB keyboard or the built-in PIN pad.
The list of designated individuals includes Anibal Alexander Canelon Aguirre (known as "Prometheus") and six of his associates: Eric Gabriel Cardenas Arzola, Jose Dario Galeano Bazurto, Anthony Wuiliam Hernandez Guerrero, Carlos Javier Martinez Armenta, Oscar Leonardo Martinez Pirona, and Alejandro Mejia Castillo.
Aguirre has allegedly developed the Ploutus malware used in ATM hacks and has been on the FBI's list of Ten Most Wanted Fugitives since March.
"While Prometheus's network is based in Mexico and Venezuela, the scheme targets U.S.-based automated teller machines (ATMs), where criminals deploy malicious software (malware) to force ATMs to dispense cash. The stolen funds are then laundered and transferred to TdA members in various countries," the Office of Foreign Assets Control (OFAC) said.
"These actions form part of a sustained, whole-of-government campaign that has resulted in over 30 actions against more than 300 individuals and entities tied to transnational criminal organizations since 2025."
The Treasury designated TdA as a Transnational Criminal Organization in July 2024, and the Department of State designated it as a Foreign Terrorist Organization in February 2025.
According to TRM Labs, the Treasury also added seven TRON addresses to its Specially Designated Nationals and Blocked Persons List (SDN List), which "have received approximately USD 6.1 million in total inflows since March 2022 [..] and sent funds to other TdA-associated addresses."
As of August 2025, TdA gang members have stolen $40.73 million from U.S. financial institutions across over 1,500 alleged ATM jackpotting attacks, according to OFAC's estimates.
Since October 2025, the U.S. Justice Department has charged 98 suspects linked to the TdA gang and involved in ATM jackpotting schemes, who are now facing maximum prison terms ranging from 20 to 335 years each.
After a wave of arrests targeting members of the Tren de Aragua Venezuelan criminal organization, the FBI warned in February that criminals had stolen over $20 million in 2025 in a massive surge of ATM hacking incidents.
Most recently, in early September, five Venezuelan nationals pleaded guilty after failing to install malware in ATM jackpotting attempts in Wamego and Manhattan, Kansas.
Build your security blueprint for AI-powered attacks
Join Mikko Hyppönen and security leaders from the NFL, CHANEL, and Atlassian for a two-hour digital summit on what AI-speed attacks change, what defenders should stop doing, and how to validate, decide, fix, and re-validate at machine speed.