US Treasury Sanctions 10 Over Tren de Aragua-Linked ATM Jackpotting Scheme
The US Department of the Treasury’s Office of Foreign Assets Control (OFAC) has sanctioned 10 individuals and multiple companies they control for their involvement in a sophisticated ATM malware operation that enabled criminals to drain cash from automated teller machines. The sanctioned parties are primarily Venezuelan nationals accused of participating in a scheme that used malware to force ATMs to dispense their full cash reserves, a tactic commonly known as "jackpotting."
According to Treasury officials, the operation is directly linked to Tren de Aragua, a violent Venezuelan criminal organization, and represents a "key source of revenue" for the group. The sanctions follow extensive investigations by US law enforcement and financial intelligence agencies into how stolen ATM funds were moved and concealed.
Scale of the ATM Jackpotting Campaign Revealed
US authorities have tracked at least 1,500 separate incidents of ATM jackpotting tied to this scheme, resulting in approximately $40.7 million in losses. These attacks involved criminals physically accessing ATMs, opening the upper compartment, connecting a laptop, and deploying malware that triggered the machines to release all available cash.
The Treasury Department shared photographic and video evidence showing suspects installing the malware onto ATMs, which was used to support the sanctions designations. The malware in question is identified as a variant of Ploutus, a well-known family of ATM-targeting software that has been monitored by cybersecurity researchers for nearly a decade.
Role of Ploutus Malware and Alleged Developer
FBI officials have previously identified Anibal Alexander Canelon Aguirre as the developer of the Ploutus malware used in these attacks. Aguirre has been added to the FBI’s Most Wanted list and is accused of organizing and deploying multiple teams across the United States to execute ATM jackpotting operations, particularly targeting machines in remote or less-monitored locations.
The Treasury Department stated it possesses photographs linking Aguirre to proceeds from the ATM thefts. Despite claims by government agencies about the connection between Ploutus, Aguirre, and Tren de Aragua, cybersecurity experts have noted that no public forensic evidence has been presented to definitively link the malware’s code to either Aguirre or the criminal group.
Money Laundering Through Cryptocurrency and Front Companies
Several of the sanctioned individuals are accused of facilitating the laundering of stolen ATM funds through cryptocurrency transactions and shell companies registered in Mexico and other jurisdictions. The proceeds were allegedly transferred to Tren de Aragua members who helped obscure the illicit origin of the funds.
Blockchain analysis firm Chainalysis provided supporting evidence, stating that the flow of money from the ATM jackpotting scheme moved through the same financial channels used by drug trafficking organizations. Their analysis showed that wallet addresses associated with Tren de Aragua had interacted with entities linked to Colombian and Mexican drug cartels, as well as a Venezuelan national previously accused of laundering one billion dollars.
Chainalysis experts emphasized that the laundering infrastructure relied on shared tools, including stablecoins, which service multiple criminal networks across Latin America, indicating a convergence of cybercrime and traditional organized crime financing methods.
Broader Legal Actions Against the Scheme
The sanctions are part of a wider effort by the US government to dismantle the ATM jackpotting network. To date, at least 98 individuals have been indicted in connection with the malware scheme. In the month prior to the sanctions announcement, five men pleaded guilty to charges related to their involvement in the operation.
Government agencies have warned for years about the evolving threat posed by Ploutus and similar malware families. Google researchers have previously described Ploutus as "one of the most advanced ATM malware families" they have observed, noting its sophistication in evading detection and enabling rapid cash extraction.
Source: The Record