The U.S. Treasury Department has sanctioned eight members of the Venezuelan gang Tren de Aragua (TdA) for their role in stealing millions of dollars in jackpot attacks on ATMs in the United States.
In jackpot attacks, criminals use malware (e.g. ATMii, ATMitch, GreenDispenserAlice, RIPPER, dusk, SUCCESSFULand Ploutus) at bank and credit union automated teller machines (ATMs), allowing them to empty cash from the ATMs and delete evidence using a connected USB keypad or the integrated PIN pad.
Those named include Anibal Alexander Canelon Aguirre (known as “Prometheus”) and six of his associates: Eric Gabriel Cardenas Arzola, Jose Dario Galeano Bazurto, Anthony Wuiliam Hernandez Guerrero, Carlos Javier Martinez Armenta, Oscar Leonardo Martinez Pirona and Alejandro Mejia Castillo.
Aguirre allegedly created and was the creator of the Ploutus malware used in ATM hacks on the FBI’s list of the ten most wanted fugitives since March.
“While Prometheus’ network is based in Mexico and Venezuela, the system targets automated teller machines (ATMs) in the United States, where criminals use malicious software (malware) to force ATMs to dispense cash. The stolen funds are then laundered and transferred to TdA members in various countries.” This was announced by the Office of Foreign Assets Control (OFAC)..
“These actions are part of an ongoing, government-wide campaign that has resulted in over 30 actions since 2025 against more than 300 individuals and entities affiliated with transnational criminal organizations.”
The Treasury Department designated TdA as a transnational criminal organization in July 2024, and the State Department designated it as a foreign terrorist organization in February 2025.
According to TRM Labs, so does the Ministry of Finance added seven TRON addresses to its Specially Designated Nationals and Blocked Persons List (SDN list), which “has received a total of approximately $6.1 million in inflows since March 2022 (..) and has sent funds to other addresses associated with TdA.”
OFAC estimates that as of August 2025, members of the TdA gang have stolen $40.73 million from U.S. financial institutions in over 1,500 suspected ATM jackpot attacks.
Since October 2025, the US Department of Justice has indicted 98 suspects associated with the TdA gang and involved in ATM jackpot schemes. They now face maximum sentences of between 20 and 335 years.
Following a wave of arrests against members of the Venezuelan criminal organization Tren de Aragua, the FBI warned in February that criminals had stolen over $20 million in a massive wave of ATM hacking incidents in 2025.
Most recently, in early September, five Venezuelan nationals pleaded guilty to failing to install malware during jackpot attempts at ATMs in Wamego and Manhattan, Kansas.
