The US Treasury Department has dealt a significant blow to the notorious Tren de Aragua (TdA) gang, blacklisting its alleged mastermind and several associates in connection with a string of ATM jackpotting attacks that have left a trail of destruction across the United States. Anibal Alexander Canelon Aguirre, aka “Prometheus,” is now on the hook for his alleged role in developing the malware used in these high-tech heists.
Canelon Aguirre’s operation is a complex web of deceit and financial manipulation that spans multiple countries. His network, based in Mexico and Venezuela, uses cryptocurrency to launder the stolen cash, which is then distributed among TdA members worldwide. The Treasury Department has estimated that as of August 2025, these jackpotting attacks had resulted in losses exceeding $40 million, with over 1,500 targeted ATMs across the US.
The process behind these attacks is both sophisticated and ruthless. First, TdA operatives surveil potential targets, identifying vulnerable ATMs that can be compromised using malware such as Ploutus. Once installed, this malicious software allows the attackers to bypass security systems remotely, after which they issue a command that forces the ATM to dispense its entire cash reserves until it runs out of money or is shut down.
The Treasury Department’s Office of Foreign Assets Control (OFAC) has designated Canelon Aguirre and seven of his associates as “specially designated nationals” (SDNs), effectively blocking any property they hold in the US. This move also prohibits US persons from engaging with these individuals, and warns foreign financial institutions that significant transactions on their behalf risk triggering secondary sanctions.
The indictment of 119 people connected to TdA is a testament to the dedication of law enforcement agencies worldwide. Several defendants have already been sentenced, including Oddry Arnoldo Cabrera Torrealba and Carlos Javier Padron, both Venezuelan nationals who received 78-month prison sentences in June. Juan Manuel Gouveia-Aguilera was sentenced to 96 months in August, marking the longest federal sentence imposed for a role in ATM jackpotting.
The Treasury Department’s actions are a significant step towards disrupting TdA’s operations and holding its leaders accountable for their crimes. However, it is crucial that individuals and businesses remain vigilant against these types of attacks. By staying informed about emerging threats and implementing robust security measures, we can all contribute to preventing the financial devastation caused by these high-tech heists.
As a practical takeaway, it is essential for banks, financial institutions, and ATM operators to regularly update their security protocols and monitor their systems for potential vulnerabilities. Moreover, individuals should be cautious when using ATMs, especially those located in isolated areas or with known security issues. By working together, we can reduce the risk of these types of attacks and safeguard our financial infrastructure.
Source: SecurityWeek — 2026-10-01