US sanctions Tren de Aragua gang members in ATM hacks crackdown
The U.S. Treasury Department has sanctioned eight members of the Venezuelan gang Tren de Aragua (TdA) for their role in the theft of millions of dollars in ATM jackpotting attacks across the United States.
In jackpotting attacks, criminals deploy malware (e.g., ATMii, ATMitch, GreenDispenser, Alice, RIPPER, Skimer, SUCEFUL, and Ploutus) on bank and credit union automated teller machines (ATMs), which allows them to empty the ATMs of cash and delete evidence via an attached USB keyboard or the built-in PIN pad.
The list of designated individuals includes Anibal Alexander Canelon Aguirre (known as "Prometheus") and six of his associates: Eric Gabriel Cardenas Arzola, Jose Dario Galeano Bazurto, Anthony Wuiliam Hernandez Guerrero, Carlos Javier Martinez Armenta, Oscar Leonardo Martinez Pirona, and Alejandro Mejia Castillo.
Aguirre has allegedly developed the Ploutus malware used in ATM hacks and has been on the FBI's list of Ten Most Wanted Fugitives since March.
"While Prometheus's network is based in Mexico and Venezuela, the scheme targets U.S.-based automated teller machines (ATMs), where criminals deploy malicious software (malware) to force ATMs to dispense cash. The stolen funds are then laundered and transferred to TdA members in various countries," the Office of Foreign Assets Control (OFAC) said.
"These actions form part of a sustained, whole-of-government campaign that has resulted in over 30 actions against more than 300 individuals and entities tied to transnational criminal organizations since 2025."
The Treasury designated TdA as a Transnational Criminal Organization in July 2024, and the Department of State designated it as a Foreign Terrorist Organization in February 2025.
Suspects installing malware in ATM jackpotting attacks (Treasury Department)According to TRM Labs, the Treasury also added seven TRON addresses to its Specially Designated Nationals and Blocked Persons List (SDN List), which "have received approximately USD 6.1 million in total inflows since March 2022 and sent funds to other TdA-associated addresses."
As of August 2025, TdA gang members have stolen $40.73 million from U.S. financial institutions across over 1,500 alleged ATM jackpotting attacks, according to OFAC's estimates.
Since October 2025, the U.S. Justice Department has charged 98 suspects linked to the TdA gang and involved in ATM jackpotting schemes, who are now facing maximum prison terms ranging from 20 to 335 years each.
After a wave of arrests targeting members of the Tren de Aragua Venezuelan criminal organization, the FBI warned in February that criminals had stolen over $20 million in 2025 in a massive surge of ATM hacking incidents.
Most recently, in early September, five Venezuelan nationals pleaded guilty after failing to install malware in ATM jackpotting attempts in Wamego and Manhattan, Kansas.
References in this story
- ATMii Malware Makes Windows 7 and Windows Vista ATMs Spit Out Cash www.bleepingcomputer.com Security researchers have discovered a new ATM malware strain named ATMii that targets only ATMs running on Windows 7 and Windows Vista.
- Self-Deleting Malware Makes ATMs Spit out Cash www.bleepingcomputer.com Security researchers have uncovered one of the most sophisticated ATM heists to date, involving a group of cyber criminals specialized in hacking bank networks using fileless malware, and ATM malware that spits out cash…
- Meet GreenDispenser: A New Breed of ATM Malware | Proofpoint US www.proofpoint.com Proofpoint research has discovered another variant of ATM malware, which we have dubbed GreenDispenser. The GreenDispenser gives cyber criminals the ability to walk up to an infected ATM and drain
- New "Alice" Malware Makes ATMs Spit Out Cash www.bleepingcomputer.com In November 2016, Europol and Trend Micro discovered a new breed of malware that targets ATMs and enables crooks with physical access to the machine's ports to make an ATM spit out cash.
- ATM infector securelist.com In 2009, instead of infecting the computers of users worldwide, criminals went directly after the ATM itself – infecting it with malware called Skimer. Seven years later, our experts discovered a new, improved, version…
- Ploutus ATM Malware: Press F3 for Money www.bleepingcomputer.com Security researchers from FireEye have identified a new variant of the Ploutus ATM malware, used for the past few years to make ATMs spew out cash on command.
- Treasury Sanctions Financial Network of Foreign Terrorist Organization, Tren de Aragua, After Theft of Millions from… home.treasury.gov **WASHINGTON**—Today, the U.S. Department of the Treasury’s Office of Foreign Assets Control (OFAC) designated 10 targets involved in a Tren de Aragua (TdA) fraud scheme that has become a key source of revenue for the…
- Treasury Sanctions Tren de Aragua ATM Jackpotting Network, Including Seven TRON Addresses | TRM Labs www.trmlabs.com OFAC designated 10 Tren de Aragua targets and seven TRON addresses that received about USD 6.1 million since 2022, according to TRM analysis.
- US charges 31 more suspects linked to ATM malware attacks www.bleepingcomputer.com A Nebraska federal grand jury charged 31 additional defendants for their involvement in an ATM jackpotting operation allegedly orchestrated by members of the Venezuelan gang Tren de Aragua.
- FBI: Over $20 million stolen in surge of ATM malware attacks in 2025 www.bleepingcomputer.com The FBI warned that Americans lost more than $20 million last year amid a massive surge in ATM "jackpotting" attacks, in which criminals use malware to force cash machines to dispense money.
- Five Venezuelans plead guilty to ATM jackpotting attacks in US www.bleepingcomputer.com Five Venezuelan nationals pleaded guilty to attempting to empty automated teller machines (ATMs) using malware in a series of ATM jackpotting attacks.
