Skip to content
Treasury Sanctions Tren de Aragua's Financial Network Amid ATM Theft Scheme

Treasury Sanctions Tren de Aragua's Financial Network Amid ATM Theft Scheme

First seen 30 Sep 2026, 19:28 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •September 30, 2026 at 20:30 UTC
  • •OFAC sanctioned 10 individuals linked to Tren de Aragua for ATM thefts.
  • •The fraud scheme uses malware to exploit U.S. ATMs, stealing millions.
  • •Anibal Alexander Canelon Aguirre, a key figure, is one of the FBI's most-wanted fugitives.

On September 30, 2026, the U.S. Department of the Treasury's OFAC sanctioned 10 individuals linked to Tren de Aragua (TdA), a Foreign Terrorist Organization involved in a fraud scheme targeting U.S. banks. The scheme, orchestrated by Anibal Alexander Canelon Aguirre (aka 'Prometheus'), utilizes malware to exploit ATMs, forcing them to dispense cash. The stolen funds are laundered and sent to TdA members in various countries. This operation is part of a broader effort to dismantle TdA's financial networks, which have been linked to various criminal activities including drug trafficking and human trafficking. The sanctions reflect ongoing government actions against transnational criminal organizations since 2025. The Treasury aims to protect the U.S. financial system from exploitation by such groups.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2026-09-30
Treasury sanctions Tren de Aragua network
OFAC designated 10 individuals involved in a fraud scheme targeting U.S. banks, linked to the Foreign Terrorist Organization Tren de Aragua.
Home.Treasury

More articles in this cluster (3)

Following this threat?

Track Magic Casa De Cambio in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (10)

1 / 2

Common questions

What is Tren de Aragua?
Tren de Aragua is a Foreign Terrorist Organization involved in various criminal activities, including drug trafficking and ATM fraud.
How does the ATM theft scheme work?
The scheme uses malware to manipulate ATMs into dispensing cash, which is then laundered and sent to TdA members.
What actions should financial institutions take?
Financial institutions should enhance security measures for ATMs and monitor for unusual activity to mitigate risks from such schemes.