Clarissa Hana
The U.S. Treasury Department has imposed sanctions on eight key members of the notorious Venezuelan criminal organization, Tren de Aragua (TdA), for their central roles in orchestrating a sophisticated and extensive ATM jackpotting scheme that has defrauded millions of dollars from financial institutions across the United States. This coordinated action by the Treasury underscores a broader, sustained governmental effort to dismantle transnational criminal enterprises exploiting digital vulnerabilities for illicit financial gain.
The targeted individuals, identified as integral to the TdA’s ATM fraud operations, include Anibal Alexander Canelon Aguirre, widely known by the moniker "Prometheus," and seven of his close associates: Eric Gabriel Cardenas Arzola, Jose Dario Galeano Bazurto, Anthony Wuiliam Hernandez Guerrero, Carlos Javier Martinez Armenta, Oscar Leonardo Martinez Pirona, and Alejandro Mejia Castillo. These designations freeze any assets these individuals may hold within U.S. jurisdiction and prohibit U.S. persons from engaging in any transactions with them, effectively severing their access to the U.S. financial system.
The Mechanics of ATM Jackpotting: A Digital Heist
ATM jackpotting represents a particularly insidious form of cybercrime, where criminals remotely compromise automated teller machines (ATMs) to force them to dispense cash. The modus operandi involves deploying specialized malware onto the targeted machines. This malicious software, examples of which include ATMii, ATMitch, GreenDispenser, Alice, RIPPER, Skimer, SUCEFUL, and Ploutus, effectively bypasses the standard security protocols and transaction validation processes.
Once infected, the ATM can be manipulated to disgorge its contents. Criminals typically gain control through an external USB keyboard connected to the machine or by directly interacting with the built-in PIN pad. This allows them to initiate fraudulent cash dispensing operations. A critical element of the jackpotting attack is the malware’s ability to subsequently erase its own presence and any digital evidence of the intrusion, making forensic investigation and attribution significantly more challenging. The stolen funds are then funneled through complex money laundering operations, often involving cryptocurrency, to obscure their origins and transfer them to TdA members operating in various countries.
"Prometheus" and the FBI’s Most Wanted List
At the heart of this specific operation, Anibal Alexander Canelon Aguirre, or "Prometheus," is alleged to be the architect behind the development of the Ploutus malware, a key tool used in these large-scale ATM hacks. Aguirre’s notoriety extends to his presence on the FBI’s Ten Most Wanted Fugitives list, where he has been listed since March of the current year, highlighting the severity of his alleged criminal activities and the concerted efforts to apprehend him.
A statement from the Office of Foreign Assets Control (OFAC), a bureau within the Department of the Treasury, detailed the scope of the operation: "While Prometheus’s network is based in Mexico and Venezuela, the scheme targets U.S.-based automated teller machines (ATMs), where criminals deploy malicious software (malware) to force ATMs to dispense cash. The stolen funds are then laundered and transferred to TdA members in various countries."
OFAC further emphasized that these sanctions are part of a broader, ongoing governmental strategy. "These actions form part of a sustained, whole-of-government campaign that has resulted in over 30 actions against more than 300 individuals and entities tied to transnational criminal organizations since 2025." This indicates a multi-pronged approach involving various U.S. agencies to combat organized crime.
A Escalating Threat: Timeline of Takedowns and Financial Impact
The designation of Tren de Aragua as a Transnational Criminal Organization by the Treasury Department in July 2024, followed by its designation as a Foreign Terrorist Organization by the Department of State in February 2025, signifies the escalating recognition of TdA’s threat level. These designations enable a wider range of enforcement actions and international cooperation to disrupt the group’s activities.
The financial ramifications of TdA’s ATM jackpotting activities are substantial. According to TRM Labs, an analytics firm specializing in blockchain intelligence, the Treasury also added seven TRON cryptocurrency addresses to its Specially Designated Nationals and Blocked Persons List (SDN List). These addresses are reported to have collectively received approximately $6.1 million in total inflows since March 2022 and subsequently transferred funds to other TdA-associated accounts, illustrating the group’s reliance on digital currencies for its illicit operations.
As of August 2025, OFAC estimates that TdA gang members have illicitly acquired a staggering $40.73 million from U.S. financial institutions through more than 1,500 alleged ATM jackpotting attacks. This figure underscores the scale of the financial damage inflicted upon the U.S. banking sector.
The U.S. Justice Department has also been actively pursuing criminal charges against individuals linked to these schemes. Since October 2025, the department has charged 98 suspects implicated in TdA-related ATM jackpotting operations. These individuals face severe penalties, with potential prison sentences ranging from 20 to a maximum of 335 years, reflecting the gravity of the offenses.
The surge in ATM hacking incidents was flagged by the FBI in February, following a significant wave of arrests targeting TdA members. At that time, the FBI warned that criminals had already stolen over $20 million in 2025 alone through a massive increase in ATM malware attacks. This warning served as a precursor to the more extensive enforcement actions now being taken.
More recently, in early September, five Venezuelan nationals pleaded guilty in U.S. federal court to charges stemming from failed ATM jackpotting attempts in Wamego and Manhattan, Kansas. While these specific attempts were unsuccessful, their guilty pleas highlight the persistent efforts of TdA operatives to infiltrate and exploit financial systems across the country.
Broader Implications and the Future of Financial Security
The Treasury’s sanctions against the Tren de Aragua members are a critical step in disrupting their financial network and hindering their ability to operate. However, the ongoing nature of these attacks suggests that the threat landscape for ATM security remains dynamic and challenging. The sophistication of the malware, coupled with the transnational nature of the criminal organization, necessitates continued vigilance and international cooperation.
The involvement of cryptocurrency in the money laundering process further complicates enforcement efforts. The ability to move funds rapidly and anonymously across borders presents a significant hurdle for law enforcement agencies seeking to trace and seize illicit gains. This underscores the growing need for enhanced collaboration between financial institutions, cybersecurity firms, and regulatory bodies to develop more robust defenses against these evolving threats.
The U.S. government’s consistent "whole-of-government" approach, as highlighted by OFAC, indicates a commitment to addressing these complex criminal enterprises through a combination of financial sanctions, law enforcement actions, and international partnerships. The ongoing efforts to combat Tren de Aragua and similar organizations are indicative of a broader struggle against the increasing convergence of organized crime and cyber threats.
Financial institutions will likely need to invest further in advanced security measures, including real-time threat detection, anomaly monitoring, and enhanced physical security for ATM infrastructure. Furthermore, public awareness campaigns about the risks associated with ATM jackpotting and the importance of reporting suspicious activity could play a vital role in bolstering collective defenses. The long-term effectiveness of these measures will depend on their adaptability to the ever-changing tactics employed by sophisticated criminal groups like Tren de Aragua.
