The U.S. Treasury Department has imposed sanctions on ten individuals and several companies, all tied to a sophisticated ATM malware scheme that has reportedly siphoned over $40 million from financial institutions. The Office of Foreign Assets Control (OFAC) announced the sanctions, linking the "jackpotting" operation to Tren de Aragua, a Venezuelan criminal organization, and identifying the scheme as a significant revenue source for the group.
U.S. officials estimate at least 1,500 attacks have occurred, resulting in confirmed losses of $40.7 million. The proceeds from these ATM thefts were allegedly transferred to Tren de Aragua members, who then laundered the funds through various channels, including cryptocurrency and shell companies in Mexico and other countries. Blockchain analysis indicates that the money laundering infrastructure used for these ATM jackpotting proceeds is shared with operations handling drug trafficking funds for Colombian and Mexican cartels, as well as a Venezuelan national previously charged with laundering $1 billion.
The Justice Department has consistently asserted "extensive direct and indirect links" between the Ploutus malware, central to the ATM jackpotting scheme, and Tren de Aragua. The sanctions are part of a broader U.S. government effort against the operation, which has already seen 98 individuals indicted and five men plead guilty to related charges.
Videos and photographs released by prosecutors and the Treasury Department depict individuals opening ATMs, connecting laptops, and installing malware that forces the machines to dispense all available cash. The FBI has identified Anibal Alexander Canelon Aguirre as the alleged developer of the Ploutus malware, adding him to their most wanted list. Aguirre is accused of deploying multiple teams across the U.S. to target ATMs, often in remote locations. The Treasury Department also possesses photographs reportedly showing Aguirre with proceeds from these crimes. Several other individuals named in the recent sanctions are accused of facilitating the laundering of these funds using cryptocurrency.
Warnings about variants of the Ploutus malware have been circulating for nearly a decade, with Google researchers previously describing it as "one of the most advanced ATM malware families" they had encountered. However, experts have not independently confirmed any direct links between Ploutus, Aguirre, or Tren de Aragua.
