U.S. Sanctions Tren de Aragua Members Over ATM Jackpotting Attacks
Summary
The U.S. Treasury sanctioned eight Tren de Aragua members over ATM jackpotting attacks that authorities say used malware to steal millions from U.S. financial institutions and launder the proceeds.
Key points
- The Treasury sanctioned eight Tren de Aragua members for their alleged roles in ATM jackpotting attacks.
- Authorities say attackers used malware, including Ploutus, to force ATMs to dispense cash.
- Anibal Alexander Canelon Aguirre, known as Prometheus, is accused of developing Ploutus.
- OFAC says stolen funds were laundered and transferred to gang associates in multiple countries.
- OFAC estimates that, as of August 2025, the gang stole $40.73 million in more than 1,500 alleged attacks.
- The Treasury also added seven TRON addresses to its sanctions list.
Article Details
- Event Type
- U.S. Treasury sanctions eight members of Tren de Aragua over their alleged roles in ATM jackpotting attacks.
- Impact
- U.S. authorities say the attacks stole millions of dollars from U.S. financial institutions. OFAC estimates that, as of August 2025, TdA members had stolen $40.73 million in more than 1,500 alleged attacks. OFAC says the stolen funds were laundered and transferred to TdA associates in various countries.
People
Alejandro Mejia CastilloListed as one of Anibal Alexander Canelon Aguirre’s associates and among the designated individuals.Anibal Alexander Canelon AguirreDesignated by the U.S. Treasury; allegedly developed the Ploutus malware and is known as “Prometheus.”Anthony Wuiliam Hernandez GuerreroListed as one of Anibal Alexander Canelon Aguirre’s associates and among the designated individuals.Carlos Javier Martinez ArmentaListed as one of Anibal Alexander Canelon Aguirre’s associates and among the designated individuals.Eric Gabriel Cardenas ArzolaListed as one of Anibal Alexander Canelon Aguirre’s associates and among the designated individuals.Jose Dario Galeano BazurtoListed as one of Anibal Alexander Canelon Aguirre’s associates and among the designated individuals.Oscar Leonardo Martinez PironaListed as one of Anibal Alexander Canelon Aguirre’s associates and among the designated individuals.
Threat Actors
Malware
AliceIn jackpotting attacks, criminals deploy malware (e.g., ATMii, ATMitch, GreenDispenser, Alice, RIPPER, Skimer, SUCEFUL, and Ploutus) on bank and credit union automated teller machines (ATMs), which allows them to emptyATMiiIn jackpotting attacks, criminals deploy malware (e.g., ATMii, ATMitch, GreenDispenser, Alice, RIPPER, Skimer, SUCEFUL, and Ploutus) on bank and credit union automated teller machines (ATMs), which allows them to emptyATMitchIn jackpotting attacks, criminals deploy malware (e.g., ATMii, ATMitch, GreenDispenser, Alice, RIPPER, Skimer, SUCEFUL, and Ploutus) on bank and credit union automated teller machines (ATMs), which allows them to emptyGreenDispenserIn jackpotting attacks, criminals deploy malware (e.g., ATMii, ATMitch, GreenDispenser, Alice, RIPPER, Skimer, SUCEFUL, and Ploutus) on bank and credit union automated teller machines (ATMs), which allows them to emptyPloutusAuthorities say the gang used malware such as Ploutus to force ATMs to dispense cash, and the case has led to major U.S.RIPPERIn jackpotting attacks, criminals deploy malware (e.g., ATMii, ATMitch, GreenDispenser, Alice, RIPPER, Skimer, SUCEFUL, and Ploutus) on bank and credit union automated teller machines (ATMs), which allows them to emptySkimerIn jackpotting attacks, criminals deploy malware (e.g., ATMii, ATMitch, GreenDispenser, Alice, RIPPER, Skimer, SUCEFUL, and Ploutus) on bank and credit union automated teller machines (ATMs), which allows them to emptySUCEFULattacks, criminals deploy malware (e.g., ATMii, ATMitch, GreenDispenser, Alice, RIPPER, Skimer, SUCEFUL, and Ploutus) on bank and credit union automated teller machines (ATMs), which allows them to empty the
Countries
Mexico“While Prometheus’s network is based in Mexico and Venezuela, the scheme targets U.S.-based automated teller machines (ATMs), where criminals deploy malicious software (malware) to force ATMs to dispense cash.United StatesTreasury Department has sanctioned eight members of the Venezuelan gang Tren de Aragua (TdA) for their role in the theft of millions of dollars in ATM jackpotting attacks across the United States.Venezuela“While Prometheus’s network is based in Mexico and Venezuela, the scheme targets U.S.-based automated teller machines (ATMs), where criminals deploy malicious software (malware) to force ATMs to dispense cash.