THE US Treasury Department has sanctioned Anibal Alexander Canelon Aguirre, known as ‘Prometheus’, described as the alleged engineer of the malware used in ATM jackpotting attacks tied to the Tren de Aragua (TdA) network. His network, based in Mexico and Venezuela, targets ATMs in the United States, with proceeds laundered (including via cryptocurrency) and distributed to TdA members abroad.
The Treasury portrays the group as conducting surveillance of potential victim machines, breaking in to install remote-activated malware that bypasses ATM security, followed by a dispense command to empty cash until the machine is exhausted or operations are halted. TdA is linked to the Ploutus family of malware, a recurring tool in these attacks. By August 2025, Treasury data puts US losses from jackpotting at more than $40 million across more than 1,500 incidents.
In parallel, the Office of Foreign Assets Control designated seven associates of Prometheus, all of whom have been indicted in Nebraska on charges including providing material support to TdA, bank fraud and money laundering conspiracies. TRM Labs identifies seven TRON addresses tied to Prometheus and six associates. The US has blocked property of the designated individuals and entities, with implications for US persons and foreign financial institutions engaging in substantial transactions.
The DOJ has charged 119 people in connection with the broader ATM jackpotting conspiracy, with several sentences already handed down, including two Venezuelan nationals receiving 78 months and another individual, Juan Manuel Gouveia-Aguilera, receiving 96 months—the DOJ stating it is the longest federal term for a role in ATM jackpotting.