The US Treasury Department has taken a significant step in cracking down on a notorious gang that has been wreaking havoc on ATMs across the country. Eight members of the Venezuelan-based Tren de Aragua (TdA) gang have been sanctioned for their involvement in the theft of millions of dollars through ATM jackpotting attacks. The scheme, which has been ongoing since at least 2025, involves deploying malware on bank and credit union automated teller machines to empty them of cash.
The sanctioned individuals include Anibal Alexander Canelon Aguirre, also known as “Prometheus,” who is alleged to have developed the Ploutus malware used in these attacks. Aguirre has been on the FBI’s list of Ten Most Wanted Fugitives since March 2026. The Treasury Department has designated TdA as a Transnational Criminal Organization and has taken steps to freeze their assets and disrupt their operations.
The impact of these actions is substantial, with over $40 million stolen from U.S. financial institutions across more than 1,500 alleged ATM jackpotting attacks. The U.S. Justice Department has charged 98 suspects linked to the TdA gang, who are facing maximum prison terms ranging from 20 to 335 years each.
But what exactly is an ATM jackpotting attack? In a nutshell, it involves deploying malware on ATMs that allows thieves to force them to dispense cash without the need for a card or PIN. The malware can be installed via an attached USB keyboard or the built-in PIN pad, making it a relatively simple and effective way for criminals to get their hands on large sums of money.
The Treasury Department’s actions are part of a broader campaign to disrupt transnational criminal organizations that have been wreaking havoc on global financial systems. The Office of Foreign Assets Control (OFAC) has added seven TRON addresses associated with TdA to its Specially Designated Nationals and Blocked Persons List, which have received approximately $6.1 million in total inflows since March 2022.
The consequences for individuals involved in these types of crimes are severe, with maximum prison terms ranging from 20 to 335 years each. The U.S. Justice Department has made it clear that it will not tolerate this type of activity and will continue to work closely with international partners to disrupt the operations of transnational criminal organizations.
As we navigate the complexities of modern cybersecurity threats, it’s essential to remember that these types of attacks are often the result of sophisticated malware and coordinated efforts by organized crime groups. While the Treasury Department’s actions are a significant step in disrupting TdA’s operations, they serve as a reminder that there is still much work to be done to protect our financial systems from these types of threats.
In light of this, it’s essential for individuals and organizations to take steps to protect themselves against ATM jackpotting attacks. This includes ensuring that ATMs are properly secured and regularly updated with the latest security patches, as well as being vigilant about suspicious activity around ATMs. By staying informed and taking proactive measures to secure our financial systems, we can all play a role in disrupting the operations of transnational criminal organizations like TdA.
Source: Bleeping Computer — 2026-10-02