US sanctions Tren de Aragua gang members in ATM hacks crackdown

Summary

The U.S. Treasury Department has sanctioned eight members of the Venezuelan gang Tren de Aragua (TdA) for their involvement in ATM jackpotting schemes that have stolen millions of dollars across the United States. These attacks involve deploying malware on ATMs to dispense cash and delete evidence. The Treasury also sanctioned seven TRON addresses linked to the gang, which have received over $6.1 million in inflows.

Full text

US sanctions Tren de Aragua gang members in ATM hacks crackdown By Sergiu Gatlan October 2, 2026 11:20 AM 0 The U.S. Treasury Department has sanctioned eight members of the Venezuelan gang Tren de Aragua (TdA) for their role in the theft of millions of dollars in ATM jackpotting attacks across the United States. In jackpotting attacks, criminals deploy malware (e.g., ATMii, ATMitch, GreenDispenser, Alice, RIPPER, Skimer, SUCEFUL, and Ploutus) on bank and credit union automated teller machines (ATMs), which allows them to empty the ATMs of cash and delete evidence via an attached USB keyboard or the built-in PIN pad. The list of designated individuals includes Anibal Alexander Canelon Aguirre (known as "Prometheus") and six of his associates: Eric Gabriel Cardenas Arzola, Jose Dario Galeano Bazurto, Anthony Wuiliam Hernandez Guerrero, Carlos Javier Martinez Armenta, Oscar Leonardo Martinez Pirona, and Alejandro Mejia Castillo. Aguirre has allegedly developed the Ploutus malware used in ATM hacks and has been on the FBI's list of Ten Most Wanted Fugitives since March. "While Prometheus's network is based in Mexico and Venezuela, the scheme targets U.S.-based automated teller machines (ATMs), where criminals deploy malicious software (malware) to force ATMs to dispense cash. The stolen funds are then laundered and transferred to TdA members in various countries," the Office of Foreign Assets Control (OFAC) said. "These actions form part of a sustained, whole-of-government campaign that has resulted in over 30 actions against more than 300 individuals and entities tied to transnational criminal organizations since 2025." The Treasury designated TdA as a Transnational Criminal Organization in July 2024, and the Department of State designated it as a Foreign Terrorist Organization in February 2025. Suspects installing malware in ATM jackpotting attacks (Treasury Department) ​According to TRM Labs, the Treasury also added seven TRON addresses to its Specially Designated Nationals and Blocked Persons List (SDN List), which "have received approximately USD 6.1 million in total inflows since March 2022 [..] and sent funds to other TdA-associated addresses." As of August 2025, TdA gang members have stolen $40.73 million from U.S. financial institutions across over 1,500 alleged ATM jackpotting attacks, according to OFAC's estimates. Since October 2025, the U.S. Justice Department has charged 98 suspects linked to the TdA gang and involved in ATM jackpotting schemes, who are now facing maximum prison terms ranging from 20 to 335 years each. After a wave of arrests targeting members of the Tren de Aragua Venezuelan criminal organization, the FBI warned in February that criminals had stolen over $20 million in 2025 in a massive surge of ATM hacking incidents. Most recently, in early September, five Venezuelan nationals pleaded guilty after failing to install malware in ATM jackpotting attempts in Wamego and Manhattan, Kansas. Build your security blueprint for AI-powered attacks Join Mikko Hyppönen and security leaders from the NFL, CHANEL, and Atlassian for a two-hour digital summit on what AI-speed attacks change, what defenders should stop doing, and how to validate, decide, fix, and re-validate at machine speed. Save your seat Related Articles: Five Venezuelans plead guilty to ATM jackpotting attacks in USUS soldier gets 70 months in prison for extorting 10 tech, telecom firmsMan gets six years for hacking 750 women's Snapchat accountsWhite House taps security firms for offensive hack-back operationsAutonomous AI agents tried to hack US, Canadian government websites

Indicators of Compromise

• malware — ATMii
• malware — ATMitch
• malware — GreenDispenser
• malware — Alice
• malware — RIPPER
• malware — Skimer
• malware — SUCEFUL
• malware — Ploutus

Entities