ATM jackpotting: US sanctions 10 tied to Tren de Aragua

The US Treasury Department has imposed sanctions on 10 people linked to an ATM jackpotting operation that used malware to force cash machines to empty themselves. US officials connect the scheme to Tren de Aragua, a Venezuelan criminal organization.

The action comes from Treasury's Office of Foreign Assets Control (OFAC), the agency that administers US economic sanctions. It targets several Venezuelan nationals and a number of companies they control. According to Treasury, these companies helped launder money taken from dozens of ATMs.

US officials have tracked at least 1,500 jackpotting attacks, with losses of $40.7 million. Treasury describes the operation as a "key source of revenue for the organization."

How the money moved

Officials say proceeds from the ATM thefts were sent to Tren de Aragua members, who then hid where the money came from. They did this in two ways: through cryptocurrency, or by moving the funds through companies they own in Mexico and other countries. Several of the people named in the sanctions announced on Wednesday are accused of helping launder the jackpotting funds with cryptocurrency.

Blockchain analysis firm Chainalysis said the jackpotting money "flow[s] through the same channels as drug trafficking money."

"Chainalysis analysis found that counterparties of the [Tren de Aragua] wallets had exposure to laundering operations used by Colombian and Mexican drug cartels, as well as a Venezuelan national charged with laundering one billion dollars," the company's experts said.

They added that "the network relied on shared laundering infrastructure, including stablecoins, that services multiple criminal organizations across Latin America."

Ploutus and the alleged developer

The scheme relies on Ploutus, an ATM malware family. The Justice Department has repeatedly claimed there are "extensive direct and indirect links" between Ploutus and Tren de Aragua.

Prosecutors and Treasury have released videos and photos that show how the attacks worked. Men pried open the top of an ATM, connected a laptop and installed the malware. Once running, Ploutus makes the machine dispense all of the cash it holds.

The FBI has previously named Anibal Alexander Canelon Aguirre as the developer of Ploutus. Aguirre is on the FBI's most wanted list. He is accused of sending multiple teams across the US to use the malware against ATMs, usually in remote locations. Treasury said it has photographs of Aguirre with proceeds from jackpotting crimes.

Experts and government agencies have warned about Ploutus variants for close to a decade. Google researchers previously called it "one of the most advanced ATM malware families" they had seen.

However, experts have not found any links between Ploutus and either Aguirre or Tren de Aragua.

Part of a wider crackdown

The sanctions are one of several US government actions against the operation. At least 98 people have been indicted for their role in the malware scheme. Last month, five men pleaded guilty to related charges.

The Bigger Picture

Sanctions work differently from indictments. They cut the targets off from the US financial system and make it risky for others to do business with them. This suggests that US authorities see the laundering side of the operation, including front companies and crypto wallets, as a weak point worth hitting. Recent cases such as the $16M pig butchering scam and the Rydox marketplace prosecution show similar pressure on financially motivated cybercrime.

Chainalysis's findings about shared stablecoin infrastructure point to a practical lesson. Following the money can expose connections between groups that seem separate. For banks and ATM operators, the case shows once more that physical access to machines in remote locations remains a real risk.

One gap is worth watching. Researchers have not independently confirmed the attribution to Aguirre and Tren de Aragua. It remains to be seen whether court proceedings will produce technical evidence that settles the question.