US Sanctions Tren de Aragua Members in ATM Hack Crackdown
US sanctions Tren de Aragua gang members in ATM hacks crackdown
The U.S. Treasury Department has imposed sanctions on eight individuals linked to the Venezuelan criminal group Tren de Aragua (TdA) for their involvement in a series of ATM jackpotting operations that resulted in the theft of millions of dollars from financial institutions across the United States. These attacks involved the deployment of malicious software to exploit vulnerabilities in automated teller machines (ATMs), enabling unauthorized cash withdrawals and data erasure. The sanctioned individuals include Anibal Alexander Canelon Aguirre, known as “Prometheus,” who is alleged to have created the Ploutus malware used in these attacks. Other designated members are Eric Gabriel Cardenas Arzola, Jose Dario Galeano Bazurto, Anthony Wuiliam Hernandez Guerrero, Carlos Javier Martinez Armenta, Oscar Leonardo Martinez Pirona, and Alejandro Mejia Castillo. Aguirre has been listed as a fugitive by the FBI since March 2023.
According to the Office of Foreign Assets Control (OFAC), the group’s operations involve deploying malware such as ATMii, ATMitch, GreenDispenser, Alice, RIPPER, Skimer, SUCEFUL, and Ploutus to compromise ATMs. The malware allows attackers to extract cash while simultaneously erasing transaction records through external USB keyboards or built-in PIN pads. The stolen funds are then laundered and transferred to TdA members in multiple countries.
The Treasury’s action is part of a broader initiative targeting transnational criminal organizations. Since 2025, over 30 measures have been taken against more than 300 individuals and entities associated with such groups. TdA was designated as a Transnational Criminal Organization by the Treasury in July 2024 and classified as a Foreign Terrorist Organization by the Department of State in February 2025.
In addition to sanctioning individuals, the Treasury added seven TRON cryptocurrency addresses to its Specially Designated Nationals and Blocked Persons List. These addresses have received approximately $6.1 million in transactions since March 2022, with funds subsequently directed to other TdA-linked accounts. OFAC estimates that TdA members have stolen $40.73 million from U.S. financial institutions through over 1,500 alleged ATM jackpotting incidents.
Since October 2025, the U.S. Justice Department has charged 98 suspects connected to the gang with involvement in these schemes, facing potential prison sentences ranging from 20 to 335 years. Recent enforcement actions include the arrest of multiple TdA members, with the FBI reporting that over $20 million was stolen in 2025 through a surge in ATM hacking incidents.
In early September, five Venezuelan nationals pleaded guilty after failing to install malware during attempted jackpotting operations in Wamego and Manhattan, Kansas. The U.S. government continues to emphasize its commitment to disrupting criminal networks that exploit financial systems. The sanctions and legal measures underscore the ongoing efforts to address cyber-enabled financial crimes and protect critical infrastructure.
According to the Office of Foreign Assets Control (OFAC), the group’s operations involve deploying malware such as ATMii, ATMitch, GreenDispenser, Alice, RIPPER, Skimer, SUCEFUL, and Ploutus to compromise ATMs. The malware allows attackers to extract cash while simultaneously erasing transaction records through external USB keyboards or built-in PIN pads.
About Author
English