Back Securityweek

Treasury Blacklists Most

Securityweek •Eduard Kovacs • October 1, 2026

The US Treasury Department has sanctioned the alleged developer of malware used in ATM jackpotting attacks linked to Tren de Aragua (TdA), along with members of his network and two Mexico-based companies.

Anibal Alexander Canelon Aguirre, known as ‘Prometheus,’ was added in March to the FBI’s Ten Most Wanted Fugitives list, becoming the first person on the list wanted for cybercrimes. Treasury describes him as “the alleged engineer of the malware used in ATM jackpotting attacks.” TdA typically uses the malware named Ploutus .

Canelon Aguirre’s network is based in Mexico and Venezuela but targets ATMs in the United States. The stolen cash is laundered, including through cryptocurrency, and moved to TdA members in various countries.

Treasury describes the attacks as follows: “Typically, after surveilling potential victim ATMs, criminal facilitators break into victim ATMs and install malware. The malware is then activated remotely, which allows criminal facilitators to bypass the ATM’s security systems. Finally, criminal facilitators push a dispense command, forcing the ATM to dispense its currency until the machine runs out of cash or until the operation is otherwise disrupted.”

As of August 2025, reported losses from jackpotting attacks across the US totaled more than $40 million, from more than 1,500 attacks, according to the Treasury Department.

In addition to Prometheus, the Office of Foreign Assets Control (OFAC) designated seven of his alleged associates. All of them have been indicted in Nebraska on charges that include providing material support to TdA, bank fraud conspiracy, bank burglary conspiracy, and money laundering conspiracy.

According to blockchain intelligence firm TRM Labs , the designations include seven TRON cryptocurrency addresses linked to Prometheus and six of his associates.

The US has now blocked any property the blacklisted individuals and entities hold in the country, and US persons are generally prohibited from dealing with them. Foreign financial institutions that conduct significant transactions on their behalf risk secondary sanctions.

The Justice Department has indicted 119 people in connection with the ATM jackpotting conspiracy. Several defendants have already been sentenced. In June, Venezuelan nationals Oddry Arnoldo Cabrera Torrealba and Carlos Javier Padron each received 78 months in prison.

In August, Juan Manuel Gouveia-Aguilera was sentenced to 96 months in prison, which the DOJ said is the longest federal sentence imposed for a role in ATM jackpotting.

Related : ShinyHunters Defiant After FBI Calls on Members to Come Forward

Related : Prison Sentence for Former US Soldier Who Hacked AT&T and Verizon

Related : Kosovar Owner of Rydox Marketplace Pleads Guilty in US Court

Eduard Kovacs (@EduardKovacs) is senior managing editor at SecurityWeek. He worked as a high school IT teacher before starting a career in journalism in 2011. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

U.S. Sanctions Target Tren de Aragua's ATM Jackpotting Scheme On September 30, 2026, the U.S. Treasury's OFAC sanctioned 10 individuals linked to Tren de Aragua (TdA), a Foreign Terrorist Organization, for their involvement in an ATM jackpotting scheme that stole over $40 million from U.S. banks. The scheme utilized malware to force ATMs to dispense cash without debiting accounts, with the stolen funds laundered through cryptocurrency and other means. Anibal Alexander Canelon Aguirre, the alleged leader of this operation, is one of the FBI's Ten Most Wanted Fugitives. The U.S. government has taken extensive actions against TdA, with over 300 individuals and entities sanctioned since 2025. The malware used in these attacks, known as Ploutus, has been linked to numerous jackpotting incidents across the U.S., causing significant financial losses. The sanctions are part of a broader strategy to disrupt the financial networks of transnational criminal organizations. The investigation revealed connections between TdA's laundering operations and known drug trafficking networks in Latin America. 6 sources 77

Extracted Entities

Treasury Blacklists Most

The full story

Extracted Entities

Attack Types (1)

Countries (3)

Industries (1)

Malware (1)