Treasury Blacklists Most-Wanted ATM Malware Developer and Cybercrime Network

Post Views: 22

The U.S. Treasury has imposed sanctions on the suspected creator of malware linked to ATM jackpotting operations tied to Tren de Aragua (TdA), alongside individuals in his network and two Mexican companies.

Sanctions and Targeted Individuals

Anibal Alexander Canelon Aguirre, identified under the alias “Prometheus,” was added to the FBI’s Ten Most Wanted Fugitives list in March, marking the first cybercrime-related entry. The Treasury describes him as “the alleged architect of malware used in ATM jackpotting attacks.”

The Suspect and His Network

Canelon Aguirre’s network operates from Mexico and Venezuela but targets ATMs across the United States. Stolen funds are laundered through cryptocurrency and distributed to TdA members globally.

Malware and Attack Methodology

The malware in question, known as Ploutus, is central to these operations. Criminal actors surveil ATMs, infiltrate them to install malware, and remotely activate it to bypass security systems. A dispense command is then executed, causing the ATM to release cash until the machine is empty or the operation is interrupted.

Attack Details and Impact

As of August 2025, reported losses from these attacks in the U.S. exceeded $40 million, stemming from over 1,500 incidents.

Financial Impact and Legal Consequences

The Office of Foreign Assets Control (OFAC) has designated seven associates of Canelon Aguirre, who face charges in Nebraska for providing material support to TdA, bank fraud conspiracy, bank burglary conspiracy, and money laundering conspiracy.

Blockchain Involvement and Sanctions

Blockchain intelligence firm TRM Labs notes that the sanctions target seven TRON cryptocurrency addresses linked to Prometheus and six of his associates. U.S. entities are prohibited from engaging with the sanctioned individuals and entities, and foreign financial institutions conducting significant transactions for them risk secondary sanctions.

Legal Actions and Sentences

The Justice Department has charged 119 individuals in connection with the ATM jackpotting conspiracy, with several convictions already handed down. In June, Venezuelan nationals Oddry Arnoldo Cabrera Torrealba and Carlos Javier Padron received 78-month prison sentences. In August, Juan Manuel Gouveia-Aguilera was sentenced to 96 months, the longest federal sentence for a role in ATM jackpotting.

The Treasury describes him as “the alleged architect of malware used in ATM jackpotting attacks.”