INSPECTING ARCHIVED INTELLIGENCE (OUTDATED VERSION).

FBI Arrests Developer of Ploutus ATM Malware

| 2026-10-08 19:08 CRITICAL MEDIUM MALWARE & BOTNETS FRAUD & CRYPTO THEFT LAW ENFORCEMENT
JSON
Executive Summary
AI-generated
US authorities have arrested and arraigned a 50-year-old Venezuelan member of the Tren de Aragua (TdA) criminal cartel, Anibal Alexander Canelon Aguirre, on charges related to a "jackpotting" scheme that compromised ATMs with malware and caused them to dispense tens of thousands of dollars in cash between February 2024 and December 2025. The group is involved in drug trafficking, smuggling, kidnapping and ransoms, human trafficking, extortion, and other financially motivated activities based mainly in Venezuela and Mexico. Canelon Aguirre allegedly laundered the proceeds through Venezuelan, Mexican, and Colombian cryptocurrency networks, including TRON. ATM jackpotting has been a major problem in much of Latin America, costing $20 million in 2025, with more than $5.1 million stolen from US banks and credit unions over two years. The attack works by physically implanting malware into cash machines, allowing remote control and dispensing thousands of dollars to money mules who then launder the proceeds through cryptocurrency networks.
Technical Mitigations AI-generated
• Ploutus-D malware version 1.0 should be patched to prevent exploitation. • The TdA group's use of cryptocurrency networks, including TRON v2.9.3 and other decentralized finance platforms, can be detected by analyzing transaction patterns and blockchain activity. • Money mules used in ATM jackpotting schemes like the one orchestrated by Anibal Alexander Canelon Aguirre should be hunted for through social media monitoring and online advertising analysis. • The TdA group's use of cryptocurrency laundering infrastructure created by criminal organizations in Colombia, Mexico, and Venezuela can be blocked or mitigated by tracking suspicious transactions on blockchain platforms.
Intelligence Metadata
Actors / Malware / CVEs / Campaigns
ShinyHuntersShinyHunters SysUpdateSysUpdate
Target & Sectors
LATAM LATAM NORTH_AMERICA NORTH_AMERICA governmentgovernment cryptocurrencycryptocurrency financefinance
Incident Timeline
‎March 2022
Threat actors linked to the Ploutus ATM malware used jackpotting attacks on ATMs, resulting in approximately USD 6.1 million inflows since March 2022.
organisation Treasury Department
Suspects installing malware in ATM jackpotting attacks (Treasury Department) ​According to TRM Labs, the Treasury also added seven TRON addresses to its Specially Designated Nationals and Blocked Persons List (SDN List), which "have received approximately USD 6.1 million in total inflows since March 2022
organisation Specially Designated Nationals
Suspects installing malware in ATM jackpotting attacks (Treasury Department) ​According to TRM Labs, the Treasury also added seven TRON addresses to its Specially Designated Nationals and Blocked Persons List (SDN List), which "have received approximately USD 6.1 million in total inflows since March 2022
general_metric 6.1 USD
Suspects installing malware in ATM jackpotting attacks (Treasury Department) ​According to TRM Labs, the Treasury also added seven TRON addresses to its Specially Designated Nationals and Blocked Persons List (SDN List), which "have received approximately USD 6.1 million in total inflows since March 2022
‎between February 2024
Threat actors linked to the Ploutus ATM malware, developed by a US individual arrested by the FBI, were involved in more than 1,500 jackpotting incidents resulting in $40.7 million stolen as of August 2025.
target_region United States
Related: South Africa Seeks Help After Cyberattack Targets Air Traffic Control The US indictment attributes $5.1 million stolen between February 2024 and December 2025 to TdA, but the US Department of the Treasury’s Office of Foreign Assets Control (OFAC) says the problem is more widespread: More than 1,500 jackpotting incidents resulted in $40.7 million stolen as of August 2025 .
source_region South Africa
Related: South Africa Seeks Help After Cyberattack Targets Air Traffic Control The US indictment attributes $5.1 million stolen between February 2024 and December 2025 to TdA, but the US Department of the Treasury’s Office of Foreign Assets Control (OFAC) says the problem is more widespread: More than 1,500 jackpotting incidents resulted in $40.7 million stolen as of August 2025 .
organisation Cyberattack Targets Air Traffic Control
Related: South Africa Seeks Help After Cyberattack Targets Air Traffic Control The US indictment attributes $5.1 million stolen between February 2024 and December 2025 to TdA, but the US Department of the Treasury’s Office of Foreign Assets Control (OFAC) says the problem is more widespread: More than 1,500 jackpotting incidents resulted in $40.7 million stolen as of August 2025 .
organisation the US Department
Related: South Africa Seeks Help After Cyberattack Targets Air Traffic Control The US indictment attributes $5.1 million stolen between February 2024 and December 2025 to TdA, but the US Department of the Treasury’s Office of Foreign Assets Control (OFAC) says the problem is more widespread: More than 1,500 jackpotting incidents resulted in $40.7 million stolen as of August 2025 .
financial $5.1 indictment
Related: South Africa Seeks Help After Cyberattack Targets Air Traffic Control The US indictment attributes $5.1 million stolen between February 2024 and December 2025 to TdA, but the US Department of the Treasury’s Office of Foreign Assets Control (OFAC) says the problem is more widespread: More than 1,500 jackpotting incidents resulted in $40.7 million stolen as of August 2025 .
general_metric 1,500 jackpotting incidents
Related: South Africa Seeks Help After Cyberattack Targets Air Traffic Control The US indictment attributes $5.1 million stolen between February 2024 and December 2025 to TdA, but the US Department of the Treasury’s Office of Foreign Assets Control (OFAC) says the problem is more widespread: More than 1,500 jackpotting incidents resulted in $40.7 million stolen as of August 2025 .
‎July 2024
The Treasury designated TdA as a Transnational Criminal Organization in July 2024.
organisation Treasury
" The Treasury designated TdA as a Transnational Criminal Organization in July 2024, and the Department of State designated it as a Foreign Terrorist Organization in February 2025.
organisation Transnational Criminal Organization
" The Treasury designated TdA as a Transnational Criminal Organization in July 2024, and the Department of State designated it as a Foreign Terrorist Organization in February 2025.
organisation the Department of State
" The Treasury designated TdA as a Transnational Criminal Organization in July 2024, and the Department of State designated it as a Foreign Terrorist Organization in February 2025.
organisation a Foreign Terrorist Organization
" The Treasury designated TdA as a Transnational Criminal Organization in July 2024, and the Department of State designated it as a Foreign Terrorist Organization in February 2025.
‎February 2025
The Treasury designated TdA as a Transnational Criminal Organization in July 2024, and the Department of State designated it as a Foreign Terrorist Organization in February 2025.
target_region United States
Designated a Terrorist Org, Captured at Sea The Trump administration designated Tren de Aragua an FTO in February 2025, and since then, has charged 120 members, at least 73 of which are in custody, according to the US officials.
organisation Designated a Terrorist Org, Captured at Sea
Designated a Terrorist Org, Captured at Sea The Trump administration designated Tren de Aragua an FTO in February 2025, and since then, has charged 120 members, at least 73 of which are in custody, according to the US officials.
organisation FTO
Designated a Terrorist Org, Captured at Sea The Trump administration designated Tren de Aragua an FTO in February 2025, and since then, has charged 120 members, at least 73 of which are in custody, according to the US officials.
data_breach 120 members
Designated a Terrorist Org, Captured at Sea The Trump administration designated Tren de Aragua an FTO in February 2025, and since then, has charged 120 members, at least 73 of which are in custody, according to the US officials.
data_breach 73 members
Designated a Terrorist Org, Captured at Sea The Trump administration designated Tren de Aragua an FTO in February 2025, and since then, has charged 120 members, at least 73 of which are in custody, according to the US officials.
organisation Treasury
" The Treasury designated TdA as a Transnational Criminal Organization in July 2024, and the Department of State designated it as a Foreign Terrorist Organization in February 2025.
organisation Transnational Criminal Organization
" The Treasury designated TdA as a Transnational Criminal Organization in July 2024, and the Department of State designated it as a Foreign Terrorist Organization in February 2025.
organisation the Department of State
" The Treasury designated TdA as a Transnational Criminal Organization in July 2024, and the Department of State designated it as a Foreign Terrorist Organization in February 2025.
organisation a Foreign Terrorist Organization
" The Treasury designated TdA as a Transnational Criminal Organization in July 2024, and the Department of State designated it as a Foreign Terrorist Organization in February 2025.
‎August 2025
The US Department of the Treasury's Office of Foreign Assets Control (OFAC) reported that more than 1,500 alleged ATM jackpotting attacks resulted in $40.73 million stolen as of August 2025.
target_region United States
Related: South Africa Seeks Help After Cyberattack Targets Air Traffic Control The US indictment attributes $5.1 million stolen between February 2024 and December 2025 to TdA, but the US Department of the Treasury’s Office of Foreign Assets Control (OFAC) says the problem is more widespread: More than 1,500 jackpotting incidents resulted in $40.7 million stolen as of August 2025 .
source_region South Africa
Related: South Africa Seeks Help After Cyberattack Targets Air Traffic Control The US indictment attributes $5.1 million stolen between February 2024 and December 2025 to TdA, but the US Department of the Treasury’s Office of Foreign Assets Control (OFAC) says the problem is more widespread: More than 1,500 jackpotting incidents resulted in $40.7 million stolen as of August 2025 .
organisation Cyberattack Targets Air Traffic Control
Related: South Africa Seeks Help After Cyberattack Targets Air Traffic Control The US indictment attributes $5.1 million stolen between February 2024 and December 2025 to TdA, but the US Department of the Treasury’s Office of Foreign Assets Control (OFAC) says the problem is more widespread: More than 1,500 jackpotting incidents resulted in $40.7 million stolen as of August 2025 .
organisation the US Department
Related: South Africa Seeks Help After Cyberattack Targets Air Traffic Control The US indictment attributes $5.1 million stolen between February 2024 and December 2025 to TdA, but the US Department of the Treasury’s Office of Foreign Assets Control (OFAC) says the problem is more widespread: More than 1,500 jackpotting incidents resulted in $40.7 million stolen as of August 2025 .
financial $5.1 indictment
Related: South Africa Seeks Help After Cyberattack Targets Air Traffic Control The US indictment attributes $5.1 million stolen between February 2024 and December 2025 to TdA, but the US Department of the Treasury’s Office of Foreign Assets Control (OFAC) says the problem is more widespread: More than 1,500 jackpotting incidents resulted in $40.7 million stolen as of August 2025 .
general_metric 1,500 jackpotting incidents
Related: South Africa Seeks Help After Cyberattack Targets Air Traffic Control The US indictment attributes $5.1 million stolen between February 2024 and December 2025 to TdA, but the US Department of the Treasury’s Office of Foreign Assets Control (OFAC) says the problem is more widespread: More than 1,500 jackpotting incidents resulted in $40.7 million stolen as of August 2025 .
" As of August 2025, TdA gang members have stolen $40.73 million from U.S. financial institutions across over 1,500 alleged ATM jackpotting attacks, according to OFAC's estimates.
organisation OFAC
" As of August 2025, TdA gang members have stolen $40.73 million from U.S. financial institutions across over 1,500 alleged ATM jackpotting attacks, according to OFAC's estimates.
financial $40.73 members
" As of August 2025, TdA gang members have stolen $40.73 million from U.S. financial institutions across over 1,500 alleged ATM jackpotting attacks, according to OFAC's estimates.
‎October 2025
The U.S. Justice Department charged 98 suspects linked to the TdA gang with ATM jackpotting schemes since October 2025, including one developer of Ploutus ATM malware.
organisation the U.S. Justice Department
Since October 2025, the U.S. Justice Department has charged 98 suspects linked to the TdA gang and involved in ATM jackpotting schemes, who are now facing maximum prison terms ranging from 20 to 335 years each.
general_metric 98 suspects
Since October 2025, the U.S. Justice Department has charged 98 suspects linked to the TdA gang and involved in ATM jackpotting schemes, who are now facing maximum prison terms ranging from 20 to 335 years each.
‎December 2025
Canelon Aguirre was indicted in the US along with 21 other individuals for bank burglary, fraud, and money laundering conspiracy.
target_region United States
Related: South Africa Seeks Help After Cyberattack Targets Air Traffic Control The US indictment attributes $5.1 million stolen between February 2024 and December 2025 to TdA, but the US Department of the Treasury’s Office of Foreign Assets Control (OFAC) says the problem is more widespread: More than 1,500 jackpotting incidents resulted in $40.7 million stolen as of August 2025 .
Canelon Aguirre was indicted in the US in December 2025 along with 21 other individuals for bank burglary, fraud, and money laundering conspiracy.
source_region South Africa
Related: South Africa Seeks Help After Cyberattack Targets Air Traffic Control The US indictment attributes $5.1 million stolen between February 2024 and December 2025 to TdA, but the US Department of the Treasury’s Office of Foreign Assets Control (OFAC) says the problem is more widespread: More than 1,500 jackpotting incidents resulted in $40.7 million stolen as of August 2025 .
organisation Cyberattack Targets Air Traffic Control
Related: South Africa Seeks Help After Cyberattack Targets Air Traffic Control The US indictment attributes $5.1 million stolen between February 2024 and December 2025 to TdA, but the US Department of the Treasury’s Office of Foreign Assets Control (OFAC) says the problem is more widespread: More than 1,500 jackpotting incidents resulted in $40.7 million stolen as of August 2025 .
organisation the US Department
Related: South Africa Seeks Help After Cyberattack Targets Air Traffic Control The US indictment attributes $5.1 million stolen between February 2024 and December 2025 to TdA, but the US Department of the Treasury’s Office of Foreign Assets Control (OFAC) says the problem is more widespread: More than 1,500 jackpotting incidents resulted in $40.7 million stolen as of August 2025 .
financial $5.1 indictment
Related: South Africa Seeks Help After Cyberattack Targets Air Traffic Control The US indictment attributes $5.1 million stolen between February 2024 and December 2025 to TdA, but the US Department of the Treasury’s Office of Foreign Assets Control (OFAC) says the problem is more widespread: More than 1,500 jackpotting incidents resulted in $40.7 million stolen as of August 2025 .
general_metric 1,500 jackpotting incidents
Related: South Africa Seeks Help After Cyberattack Targets Air Traffic Control The US indictment attributes $5.1 million stolen between February 2024 and December 2025 to TdA, but the US Department of the Treasury’s Office of Foreign Assets Control (OFAC) says the problem is more widespread: More than 1,500 jackpotting incidents resulted in $40.7 million stolen as of August 2025 .
organisation the US
Canelon Aguirre was indicted in the US in December 2025 along with 21 other individuals for bank burglary, fraud, and money laundering conspiracy.
general_metric 21 other individuals
Canelon Aguirre was indicted in the US in December 2025 along with 21 other individuals for bank burglary, fraud, and money laundering conspiracy.
‎March 2026
Anibal Alexander Canelon Aguirre, also known as 'Prometheus' and 'The Engineer', was arrested by the FBI on October 2.
target_region United States
On October 2, Anibal Alexander Canelon Aguirre, 50, also known as ‘Prometheus’ and ‘The Engineer’, who was sanctioned last week by the US Treasury, appeared in court to face charges associated with his role in TdA. He has been on the FBI’s top 10 most wanted fugitives list since March 2026, becoming the first individual added to that list for cybercrimes.
attribution FBI
On October 2, Anibal Alexander Canelon Aguirre, 50, also known as ‘Prometheus’ and ‘The Engineer’, who was sanctioned last week by the US Treasury, appeared in court to face charges associated with his role in TdA. He has been on the FBI’s top 10 most wanted fugitives list since March 2026, becoming the first individual added to that list for cybercrimes.
general_metric 10 entities
On October 2, Anibal Alexander Canelon Aguirre, 50, also known as ‘Prometheus’ and ‘The Engineer’, who was sanctioned last week by the US Treasury, appeared in court to face charges associated with his role in TdA. He has been on the FBI’s top 10 most wanted fugitives list since March 2026, becoming the first individual added to that list for cybercrimes.
organisation the US Treasury
On October 2, Anibal Alexander Canelon Aguirre, 50, also known as ‘Prometheus’ and ‘The Engineer’, who was sanctioned last week by the US Treasury, appeared in court to face charges associated with his role in TdA. He has been on the FBI’s top 10 most wanted fugitives list since March 2026, becoming the first individual added to that list for cybercrimes.
‎2026/08/31
At least 98 people, including five who pleaded guilty to related charges, were indicted for their alleged roles in the Ploutus ATM malware scheme.
general_metric 98 suspects
At least 98 people have been indicted for their role in the malware scheme and five men pleaded guilty to related charges last month.
‎2026/09/29
Anibal Alexander Canelon Aguirre, also known as 'Prometheus' and 'The Engineer', was arrested by the FBI on October 2.
target_region United States
On October 2, Anibal Alexander Canelon Aguirre, 50, also known as ‘Prometheus’ and ‘The Engineer’, who was sanctioned last week by the US Treasury, appeared in court to face charges associated with his role in TdA. He has been on the FBI’s top 10 most wanted fugitives list since March 2026, becoming the first individual added to that list for cybercrimes.
attribution FBI
On October 2, Anibal Alexander Canelon Aguirre, 50, also known as ‘Prometheus’ and ‘The Engineer’, who was sanctioned last week by the US Treasury, appeared in court to face charges associated with his role in TdA. He has been on the FBI’s top 10 most wanted fugitives list since March 2026, becoming the first individual added to that list for cybercrimes.
general_metric 10 entities
On October 2, Anibal Alexander Canelon Aguirre, 50, also known as ‘Prometheus’ and ‘The Engineer’, who was sanctioned last week by the US Treasury, appeared in court to face charges associated with his role in TdA. He has been on the FBI’s top 10 most wanted fugitives list since March 2026, becoming the first individual added to that list for cybercrimes.
organisation the US Treasury
On October 2, Anibal Alexander Canelon Aguirre, 50, also known as ‘Prometheus’ and ‘The Engineer’, who was sanctioned last week by the US Treasury, appeared in court to face charges associated with his role in TdA. He has been on the FBI’s top 10 most wanted fugitives list since March 2026, becoming the first individual added to that list for cybercrimes.
‎October 2
Anibal Alexander Canelon Aguirre, also known as 'Prometheus' and 'The Engineer', was arrested by the FBI on October 2.
target_region United States
On October 2, Anibal Alexander Canelon Aguirre, 50, also known as ‘Prometheus’ and ‘The Engineer’, who was sanctioned last week by the US Treasury, appeared in court to face charges associated with his role in TdA. He has been on the FBI’s top 10 most wanted fugitives list since March 2026, becoming the first individual added to that list for cybercrimes.
attribution FBI
On October 2, Anibal Alexander Canelon Aguirre, 50, also known as ‘Prometheus’ and ‘The Engineer’, who was sanctioned last week by the US Treasury, appeared in court to face charges associated with his role in TdA. He has been on the FBI’s top 10 most wanted fugitives list since March 2026, becoming the first individual added to that list for cybercrimes.
general_metric 10 entities
On October 2, Anibal Alexander Canelon Aguirre, 50, also known as ‘Prometheus’ and ‘The Engineer’, who was sanctioned last week by the US Treasury, appeared in court to face charges associated with his role in TdA. He has been on the FBI’s top 10 most wanted fugitives list since March 2026, becoming the first individual added to that list for cybercrimes.
organisation the US Treasury
On October 2, Anibal Alexander Canelon Aguirre, 50, also known as ‘Prometheus’ and ‘The Engineer’, who was sanctioned last week by the US Treasury, appeared in court to face charges associated with his role in TdA. He has been on the FBI’s top 10 most wanted fugitives list since March 2026, becoming the first individual added to that list for cybercrimes.
‎2026/10/08
The US government has arrested Anibal Alexander Canelon Aguirre, the developer of Ploutus ATM malware linked to Tren de Aragua gang.
organisation the Tren de Aragua
US authorities have arrested and arraigned a 50-year-old Venezuelan member of the Tren de Aragua (TdA) criminal cartel, Anibal Alexander Canelon Aguirre, on charges related to a "jackpotting" scheme that compromised ATMs with malware and caused them to dispense tens of thousands of dollars in cash.
organisation TdA
US authorities have arrested and arraigned a 50-year-old Venezuelan member of the Tren de Aragua (TdA) criminal cartel, Anibal Alexander Canelon Aguirre, on charges related to a "jackpotting" scheme that compromised ATMs with malware and caused them to dispense tens of thousands of dollars in cash.
According to the US, TdA is a violent transnational criminal organization that engages in different types of trafficking, robbery, fraud, extortion, and various types of financial crimes targeting US organizations, including ATM jackpotting .
The U.S. Treasury Department has sanctioned eight members of the Venezuelan gang Tren de Aragua (TdA) for their role in the theft of millions of dollars in ATM jackpotting attacks across the United States.
organisation Cartel
" A Cartel's Cybercrime Leader Canelon Aguirre — also known as "Prometheus" and "The Engineer" — is a leader in the cartel, and the principal architect of the Ploutus-D malware used to compromise and control the ATMs targeted in the scheme, according to the US Attorney's Office for the District of Nebraska, which is spearheading prosecution of the group.
organisation Ploutus
" A Cartel's Cybercrime Leader Canelon Aguirre — also known as "Prometheus" and "The Engineer" — is a leader in the cartel, and the principal architect of the Ploutus-D malware used to compromise and control the ATMs targeted in the scheme, according to the US Attorney's Office for the District of Nebraska, which is spearheading prosecution of the group.
ATM jackpotting activities and the developer of the infamous Ploutus ATM malware has been arrested.
The Justice Department has repeatedly claimed there are “extensive direct and indirect links” between the Ploutus malware used in the ATM jackpotting scheme and Tren de Aragua.
organisation Office for the District of
" A Cartel's Cybercrime Leader Canelon Aguirre — also known as "Prometheus" and "The Engineer" — is a leader in the cartel, and the principal architect of the Ploutus-D malware used to compromise and control the ATMs targeted in the scheme, according to the US Attorney's Office for the District of Nebraska, which is spearheading prosecution of the group.
financial $20 institutions
" ATM jackpotting has been a major problem in much of Latin America, but the scheme has increasingly moved to target US financial institutions, costing $20 million in 2025 .
After a wave of arrests targeting members of the Tren de Aragua Venezuelan criminal organization, the FBI warned in February that criminals had stolen over $20 million in 2025 in a massive surge of ATM hacking incidents.
organisation The US Coast Guard
The US Coast Guard captured Canelon Aguirre at sea in September, the US Attorney's Office for the District of Nebraska confirmed.
financial $1 States
Figueria has been charged by the United States with laundering approximately $1 billion in illicit funds .
infrastructure 40 machines
Source: US DOJ The malware also uses the Kalignite multi-ATM platform that allows it to be used on more than 40 ATM vendors' machines and other operating systems.
organisation ATM
According to the US, TdA is a violent transnational criminal organization that engages in different types of trafficking, robbery, fraud, extortion, and various types of financial crimes targeting US organizations, including ATM jackpotting .
US sanctions Tren de Aragua gang members in ATM hacks crackdown.
US sanctions 10 over ATM malware scheme tied to Tren de Aragua.
Related: Warlock Ransomware Hits Large Spanish, Portuguese Orgs "Tren de Aragua is using ATM malware as a terrorist financing tool, then moving the cash onto TRON so it looks like ordinary exchange deposits," Ari Redbord, global head of policy at TRM Labs, a blockchain analysis firm, tells Dark Reading.
organisation The U.S. Treasury Department
The U.S. Treasury Department has sanctioned eight members of the Venezuelan gang Tren de Aragua (TdA) for their role in the theft of millions of dollars in ATM jackpotting attacks across the United States.
financial $35 addresses
" The addresses also sent approximately $35 million to a network associated with a Venezuelan national, Jorge Figueira, according to an analysis by blockchain-intelligence firm TRM Labs .
organisation TRON
He allegedly then laundered the proceeds through Venezuelan, Mexican, and Colombian cryptocurrency networks, including the decentralized finance trading platform known as TRON.
organisation Treasury
Treasury’s Office of Foreign Assets Control (OFAC) targeted multiple Venezuelan nationals and several companies they control that are part of the effort to launder the money stolen from dozens of ATMs.
organisation Office of Foreign Assets Control (OFAC
Treasury’s Office of Foreign Assets Control (OFAC) targeted multiple Venezuelan nationals and several companies they control that are part of the effort to launder the money stolen from dozens of ATMs.
organisation The Justice Department
The Justice Department has repeatedly claimed there are “extensive direct and indirect links” between the Ploutus malware used in the ATM jackpotting scheme and Tren de Aragua.
organisation Identify Alleged
Police Shut Down KillSec Ransomware, Identify Alleged Teen Leader Related: Prison Sentence for Former US Soldier Who Hacked AT&T and Verizon
organisation AT&T
Police Shut Down KillSec Ransomware, Identify Alleged Teen Leader Related: Prison Sentence for Former US Soldier Who Hacked AT&T and Verizon
financial $40.7 attacks
U.S. officials have tracked at least 1,500 of the attacks causing $40.7 million in losses.
organisation OFAC
The 10 entities sanctioned by OFAC in September included seven TRON addresses, a popular decentralized cryptocurrency network.
organisation The Treasury Department
The Treasury Department sanctioned 10 people for their role in a lucrative scheme involving malware that allowed people to drain ATMs of their cash.
Prosecutors and the Treasury Department shared videos and photos of men cracking open the top of ATMs, linking a laptop to it and installing the malware.
organisation Google
A 2017 analysis of Ploutus-D — the "D" designates that it targets ATM models sold by Diebold — attempts to obfuscate it operations, kill security processes, dispense cash, and delete traces of itself to make analysis more difficult, according to a 2017 analysis by Google's Mandiant .
threat_actor ShinyHunters
Related: Alleged ShinyHunters Leader Arrested in Jordan Related:
organisation GreenDispenser
In jackpotting attacks, criminals deploy malware (e.g., ATMii , ATMitch , GreenDispenser , Alice , RIPPER , Skimer , SUCEFUL , and Ploutus ) on bank and credit union automated teller machines (ATMs), which allows them to empty the ATMs of cash and delete evidence via an attached USB keyboard or the built-in PIN pad.
organisation USB
In jackpotting attacks, criminals deploy malware (e.g., ATMii , ATMitch , GreenDispenser , Alice , RIPPER , Skimer , SUCEFUL , and Ploutus ) on bank and credit union automated teller machines (ATMs), which allows them to empty the ATMs of cash and delete evidence via an attached USB keyboard or the built-in PIN pad.
organisation PIN
In jackpotting attacks, criminals deploy malware (e.g., ATMii , ATMitch , GreenDispenser , Alice , RIPPER , Skimer , SUCEFUL , and Ploutus ) on bank and credit union automated teller machines (ATMs), which allows them to empty the ATMs of cash and delete evidence via an attached USB keyboard or the built-in PIN pad.
organisation Anibal Alexander Canelon Aguirre
The list of designated individuals includes Anibal Alexander Canelon Aguirre (known as "Prometheus") and six of his associates: Eric Gabriel Cardenas Arzola, Jose Dario Galeano Bazurto, Anthony Wuiliam Hernandez Guerrero, Carlos Javier Martinez Armenta, Oscar Leonardo Martinez Pirona, and Alejandro Mejia Castillo.
organisation the Office of Foreign Assets Control (OFAC
The stolen funds are then laundered and transferred to TdA members in various countries," the Office of Foreign Assets Control (OFAC) said .
organisation NFL
Join Mikko Hyppönen and security leaders from the NFL, CHANEL, and Atlassian for a two-hour digital summit on what AI-speed attacks change, what defenders should stop doing, and how to validate, decide, fix, and re-validate at machine speed.
organisation CHANEL
Join Mikko Hyppönen and security leaders from the NFL, CHANEL, and Atlassian for a two-hour digital summit on what AI-speed attacks change, what defenders should stop doing, and how to validate, decide, fix, and re-validate at machine speed.
Tactical Metrics
Metrics
financial
20,000,000
Financial Impact / Stolen Funds
" ATM jackpotting has been a major problem in much of Latin America, but the scheme has increasingly moved to target US financial institutions, costing $20 million in 2025 .
After a wave of arrests targeting members of the Tren de Aragua Venezuelan criminal organization, the FBI warned in February that criminals had stolen over $20 million in 2025 in a massive surge of ATM hacking incidents.
Metrics
financial
5,100,000
Financial Impact / Stolen Funds
Related: South Africa Seeks Help After Cyberattack Targets Air Traffic Control The US indictment attributes $5.1 million stolen between February 2024 and December 2025 to TdA, but the US Department of the Treasury’s Office of Foreign Assets Control (OFAC) says the problem is more widespread: More than 1,500 jackpotting incidents resulted in $40.7 million stolen as of August 2025 .
Metrics
data_breach
120
Members
Designated a Terrorist Org, Captured at Sea The Trump administration designated Tren de Aragua an FTO in February 2025, and since then, has charged 120 members, at least 73 of which are in custody, according to the US officials.
Metrics
data_breach
73
Members
Designated a Terrorist Org, Captured at Sea The Trump administration designated Tren de Aragua an FTO in February 2025, and since then, has charged 120 members, at least 73 of which are in custody, according to the US officials.
Metrics
financial
1,000,000,000
Financial Impact / Stolen Funds
Figueria has been charged by the United States with laundering approximately $1 billion in illicit funds .
Metrics
infrastructure
40
Machines
Source: US DOJ The malware also uses the Kalignite multi-ATM platform that allows it to be used on more than 40 ATM vendors' machines and other operating systems.
Metrics
financial
35,000,000
Financial Impact / Stolen Funds
" The addresses also sent approximately $35 million to a network associated with a Venezuelan national, Jorge Figueira, according to an analysis by blockchain-intelligence firm TRM Labs .
Metrics
financial
40,730,000
Members
" As of August 2025, TdA gang members have stolen $40.73 million from U.S. financial institutions across over 1,500 alleged ATM jackpotting attacks, according to OFAC's estimates.
Metrics
financial
40,700,000
Attacks
U.S. officials have tracked at least 1,500 of the attacks causing $40.7 million in losses.
Intelligence Sources
BleepingComputer 2026-10-02
TheRecord 2026-09-30
SecurityWeek 2026-10-06
Dark Reading 2026-10-08