The US Treasury has sanctioned a Tren de Aragua network accused of using malware to force ATMs to release cash. The alleged jackpotting attacks caused $40.73 million in reported US losses across more than 1,500 incidents as of August 2025, according to Treasury.
On September 30, 2026, the Office of Foreign Assets Control (OFAC) designated eight individuals and two Mexico-based companies connected to the scheme.
It separately sanctioned a gang leader involved in illicit gold mining and added seven TRON cryptocurrency addresses to its Specially Designated Nationals and Blocked Persons List.
The action targets both the alleged ATM attack operation and the financial channels used to move stolen money across borders.
ATM Malware Enables Jackpotting
Jackpotting attacks manipulate cash machines rather than withdraw money through legitimate customer transactions.
Criminals exploit weaknesses in ATMs or interactive teller machines and install malware that forces the devices to dispense cash without debiting an account.
The reported attack sequence involves watching a target machine, installing malicious software, and remotely activating it to bypass security controls.
Remote activation follows compromise of the machine; it does not establish that attackers can infect every ATM directly over the internet.
.webp)
The network operates from Mexico and Venezuela while targeting machines in the United States. Treasury says stolen funds are laundered, including through cryptocurrency transactions, before being transferred to gang members in different countries.
The primary target is Anibal Alexander Canelon Aguirre, known as “Prometheus.” Treasury alleges that he engineered the malware used in the attacks.
His alleged associates include Eric Gabriel Cardenas Arzola, Jose Dario Galeano Bazurto, Anthony Wuiliam Hernandez Guerrero, Carlos Javier Martinez Armenta, Oscar Leonardo Martinez Pirona, and Alejandro Mejia Castillo.
Another designated individual, Aslhy Javier Galeano Basurto, also faces charges connected to the scheme. The charges include material support, bank fraud conspiracy, bank burglary conspiracy, and money laundering conspiracy. These remain allegations, and defendants are presumed innocent unless proven guilty.
TRM Labs found that the seven sanctioned TRON addresses received approximately $6.1 million since March 2022. However, the company cautioned that not all incoming funds necessarily came from jackpotting attacks.
The address attributed to Cardenas Arzola received the largest share, approximately $2.1 million.
All seven addresses are deposit addresses hosted at a centralized cryptocurrency exchange, not independent self-custodied wallets. Most had been inactive for months, with the latest reported inflow occurring in July 2026.
The addresses also transferred funds to other wallets associated with Tren de Aragua. This makes transaction relationships important for investigators assessing the wider network, rather than treating each sanctioned address as an isolated account, trmlabs said.
Financial institutions and virtual asset service providers should screen the listed addresses, review historical transactions, and assess indirect exposure. Exchange operators may also identify underlying account holders and related accounts.
Join 16,000+ SOC teams using ANY.RUN to streamline threat investigations and reduce manual effort. Explore for your team
