US sanctions Tren de Aragua gang members over ATM jackpotting attacks

Treasury targets eight individuals linked to Ploutus malware scheme

By LineZotpaper

Published3 October 2026

Read Time2 min

The U.S. Treasury Department has sanctioned eight members of the Venezuelan gang Tren de Aragua (TdA) for their role in stealing millions of dollars through ATM jackpotting attacks across the United States, deploying malware such as Ploutus to force machines to dispense cash.

The Treasury’s Office of Foreign Assets Control (OFAC) designated eight individuals on Thursday, including Anibal Alexander Canelon Aguirre, known as “Prometheus,” who is alleged to have developed the Ploutus malware used in the hacks. Aguirre has been on the FBI’s Ten Most Wanted Fugitives list since March. Six associates were also named: Eric Gabriel Cardenas Arzola, Jose Dario Galeano Bazurto, Anthony Wuiliam Hernandez Guerrero, Carlos Javier Martinez Armenta, Oscar Leonardo Martinez Pirona, and Alejandro Mejia Castillo.

In jackpotting attacks, criminals install malware on bank and credit union ATMs via a USB keyboard or the built-in PIN pad, allowing them to empty the machines of cash and delete evidence. Malware variants used in the scheme include ATMii, ATMitch, GreenDispenser, Alice, RIPPER, Skimer, SUCEFUL, and Ploutus.

“While Prometheus’s network is based in Mexico and Venezuela, the scheme targets U.S.-based automated teller machines (ATMs), where criminals deploy malicious software (malware) to force ATMs to dispense cash. The stolen funds are then laundered and transferred to TdA members in various countries,” OFAC said in a press release. The Treasury noted the sanctions are part of a broader campaign that has resulted in over 30 actions against more than 300 individuals and entities tied to transnational criminal organizations since 2025.

The Treasury designated TdA as a Transnational Criminal Organization in July 2024, and the State Department designated it as a Foreign Terrorist Organization in February 2025.

Analysis

Why This Matters

ATM jackpotting directly affects consumers and financial institutions, with millions stolen before detection.
The sanctions signal a coordinated U.S. government effort to target the financial infrastructure of violent criminal networks.
The designation may hinder the gang’s ability to move money, but physical arrests remain the key to stopping attacks.

Background

ATM jackpotting attacks have been reported globally for over a decade, with criminals using malware to override cash-dispensing controls. Tren de Aragua originated in Venezuelan prisons and has expanded across Latin America and into the United States, engaging in drug trafficking, human smuggling, and extortion. The U.S. government has increasingly used sanctions and terrorist designations to disrupt such transnational criminal organizations.

Key Perspectives

Law enforcement and Treasury officials: Sanctions freeze assets and block financial transactions, making it harder for the gang to launder stolen funds and operate internationally. Banks and credit unions: Institutions face pressure to upgrade ATM security, deploy anti-malware measures, and train staff to detect tampering. Critics and skeptics: Sanctions alone may not prevent attacks if perpetrators remain at large; the network can shift to new money mules or unlicensed hawala systems.

What to Watch

Whether Aguirre and the other sanctioned individuals are arrested or surrender.
Trends in ATM jackpotting incidents in the U.S. over the coming months.
Potential expansion of sanctions to additional TdA facilitators or money launderers.

Sources

US sanctions Tren de Aragua gang members in ATM hacks crackdown — BleepingComputer