US sanctions alleged Ploutus ATM malware network tied to Tren de Aragua

Treasury sanctioned alleged Ploutus developer Anibal Canelon Aguirre and his network over US ATM jackpotting that officials tie to Tren de Aragua.

The US Treasury’s OFAC sanctioned Anibal Alexander Canelon Aguirre, known as Prometheus, whom officials identify as the developer of Ploutus malware used in ATM jackpotting attacks they attribute to Tren de Aragua, along with associates and companies in a network based in Mexico and Venezuela that targets US ATMs. The Record says 10 people and the companies they control were designated, while SecurityWeek says the action covered Aguirre, seven associates, and two Mexico-based companies and that OFAC named seven TRON addresses. Officials cite at least 1,500 attacks and roughly $40.7 million in losses—SecurityWeek describes losses as more than $40 million as of August 2025—and Chainalysis said related proceeds moved through stablecoins and cartel-linked channels. The sources disagree on criminal cases: The Record reports at least 98 indictments and five guilty pleas last month, whereas SecurityWeek reports 119 indictments and federal sentences of 78 to 96 months. SecurityWeek calls Prometheus the first FBI Ten Most Wanted fugitive sought for cybercrimes, while The Record notes that some experts have not independently linked Ploutus to Aguirre or Tren de Aragua. US persons generally cannot deal with the designated parties.

• OFAC sanctioned Anibal Alexander Canelon Aguirre (also known as Prometheus), whom officials call the Ploutus ATM-malware developer, plus associates and companies in a Mexico- and Venezuela-based network that officials tie to Tren de Aragua…
• Designation totals differ: The Record says 10 people and companies they control; SecurityWeek says Aguirre, seven alleged associates, and two Mexico-based companies, and that OFAC named seven TRON addresses tied to Prometheus and six…
• Authorities cite at least 1,500 attacks; The Record puts losses at about $40.7 million, while SecurityWeek says more than $40 million in US losses as of August 2025.
• Prosecution figures disagree: The Record says at least 98 people have been indicted and five men pleaded guilty last month; SecurityWeek says the Justice Department has indicted 119 people and that several defendants received sentences of…
• SecurityWeek says Prometheus is the first FBI Ten Most Wanted fugitive sought for cybercrimes; US persons generally cannot deal with the designated individuals or entities.
• Chainalysis reported related wallets moved through stablecoins and cartel-linked laundering channels; The Record notes some experts have not independently linked Ploutus to Aguirre or Tren de Aragua.
• Treasury describes jackpotting proceeds as a key revenue source for Tren de Aragua.