Tren de Aragua ATM jackpotting: OFAC sanctions network and seven TRON addresses; 'Prometheus' arrested

Executive Summary

On September 30, 2026, the U.S. Department of the Treasury's Office of Foreign Assets Control (OFAC) designated a Tren de Aragua (TdA) financial network built around ATM "jackpotting" — a cyberattack that uses malware to force cash machines to dispense currency without debiting an account.¹ The action added eight individuals and two Mexico-based companies tied to the jackpotting scheme to the Specially Designated Nationals and Blocked Persons List (SDN List), together with a separately designated TdA gold-mining leader, Juan Gabriel Rivas Nunez ("Juancho").¹² Seven TRON (TRX) cryptocurrency addresses, each attributed to one of the designated individuals, were added to the SDN List as on-chain identifiers.²³

Treasury describes the scheme as a key revenue stream for TdA, a group the U.S. Department of State designated a Foreign Terrorist Organization (FTO) on February 20, 2025 and that OFAC had earlier designated a Transnational Criminal Organization on July 11, 2024.¹ According to Treasury, reported losses from alleged TdA ATM jackpotting attacks in the United States totaled $40.73 million across more than 1,500 attacks as of August 2025.¹ The lead figure is Anibal Alexander Canelon Aguirre ("Prometheus," "The Engineer"), the alleged engineer of the malware, who was placed on the FBI's Ten Most Wanted Fugitives list in March 2026 — the first cyber fugitive ever added to that list.¹⁴⁵

This is both a sanctions action and a criminal prosecution, and the two should not be conflated. Canelon Aguirre and seven co-designees were indicted in the U.S. District Court for the District of Nebraska; Rivas Nunez was indicted in the Southern District of Texas in December 2025.¹⁴ The sanctions designation is an executive measure under Executive Orders 13581 and 13224, while guilt on the criminal charges remains to be proven. Two days after the designation, on October 2, 2026, the Justice Department announced that Canelon Aguirre had been apprehended, returned to the United States, and arraigned in Nebraska, where he entered not-guilty pleas and was detained pending trial.⁴

The case matters on three counts: it is the first time a cyber actor has topped the FBI's most-wanted list, it marries named defendants to blockchain identifiers in a counter-terrorism sanctions action, and it exposes a gap readers routinely misread — the $40.73 million figure counts reported losses from alleged attacks as of August 2025, while the approximately $6.1 million that blockchain-intelligence firm TRM Labs traced to the seven designated wallets is a different measure (total inflows since March 2022, not all of it tied to jackpotting).¹³

Verification of Claims

1. Claim: OFAC designated eight individuals, two Mexican companies and seven TRON addresses on September 30, 2026. → Verified → OFAC's press release and its Recent Actions SDN entry list all eight individuals, both entities (Enigma Community, S. de R.L. de C.V. and Soluciones Integrales Toluca, S.A. de C.V.), the separately designated Juan Gabriel Rivas Nunez, and the seven TRX addresses.¹²

2. Claim: Anibal Alexander Canelon Aguirre is the engineer of the ATM jackpotting malware. → Partially verified → Treasury calls him the "alleged engineer" of the malware and DOJ alleges he developed the "Ploutus" malware; both frame it as an allegation, and he has pleaded not guilty.¹⁴

3. Claim: TdA jackpotting caused $40.73 million in losses across more than 1,500 attacks. → Partially verified → The figure is Treasury's, expressly scoped as "reported losses from alleged ATM jackpotting attacks" in the United States "as of August 2025"; it is a reported, not independently adjudicated, total and a snapshot more than a year before the designation.¹

4. Claim: The seven designated TRON addresses received about $6.1 million. → Partially verified → TRM Labs reports approximately $6.1 million in total inflows to the seven addresses since March 2022 and states that "not all of that value is necessarily tied to the jackpotting scheme"; it is distinct from Treasury's $40.73 million loss figure.³

5. Claim: Canelon Aguirre was apprehended and arraigned in Nebraska. → Verified → DOJ announced on October 2, 2026 that he made his initial appearance before a U.S. Magistrate Judge, entered not-guilty pleas to four counts, and was detained pending trial.⁴

Timeline

Operation Anatomy

Surveillance and physical access

Treasury describes a multi-phase operation: criminal facilitators first surveil potential victim ATMs, then physically break into the machines to install malware.¹ The FBI states the conspiracy deployed "numerous crews" into the United States and that the activity dates to at least January 2024.⁵

Malware deployment — Ploutus

DOJ names the malware family as Ploutus, a strain purpose-built for ATM jackpotting.⁴ Co-conspirators deployed a Ploutus variant onto ATMs in person; once installed and activated, the malware let the operators issue commands to the machine's cash-dispensing module (T1657).⁴⁶

Remote activation and forced dispense

The malware is activated remotely, bypassing the ATM's security controls, after which a dispense command forces the machine to pay out until it runs empty or the operation is disrupted.¹⁴ No account is debited — the loss falls on the financial institution.¹

Anti-forensics and self-deletion

DOJ's description of Ploutus details anti-analysis measures: software-protection utilities to prevent reverse-engineering and debugging (T1622, T1027.002), and routines that delete the malware from the ATM after use to conceal its deployment from the bank (T1070.004).⁴⁶

Laundering and movement of proceeds

Dispensed cash is collected and laundered, including through cryptocurrency, then transferred to TdA members in multiple countries.¹ TRM Labs found the seven designated TRON addresses are exchange-hosted deposit addresses that received funds from many sources and, in turn, sent value onward to other TdA-associated addresses — which ultimately moved roughly $35 million to a network U.S. authorities affiliate with Jorge Figueira, a Venezuelan national charged (not convicted) with laundering about $1 billion.³

Accused

Attribution and naming basis: Every person named here is identified because OFAC added them to the SDN List on September 30, 2026 and because U.S. prosecutors have charged them by name in federal indictments.¹²⁴ Criminal charges are allegations; all charged defendants are presumed innocent unless and until proven guilty. The threat actor is the organization, Tren de Aragua, a designated FTO and TCO.¹

Anibal Alexander Canelon Aguirre (aliases "Prometheus," "The Engineer"; DOB May 15, 1976; Venezuela) is the alleged engineer and developer of the Ploutus malware and an alleged principal leader of the conspiracy.¹⁴ He was added to the FBI's Ten Most Wanted Fugitives list on March 13, 2026 — described by the FBI as the first cyber fugitive and the 540th individual ever listed — with a reward of up to $1,000,000.⁴⁵ A federal arrest warrant issued in the District of Nebraska on December 9, 2025, and he was indicted there in December 2025 on four counts, with the following statutory maxima stated by DOJ:⁴⁵

• Count I — Conspiracy to Commit Bank Fraud: up to 30 years.
• Count II — Conspiracy to Commit Bank Burglary and Fraud in Connection with Computers: up to 5 years.
• Count III — Conspiracy to Commit Money Laundering: up to 20 years.
• Count IV — Conspiracy to Provide Material Support to Terrorists: up to 15 years.

He made his initial appearance on October 2, 2026, entered not-guilty pleas, and remains detained in the District of Nebraska pending trial.⁴

Co-designated associates indicted in the District of Nebraska. Carlos Javier Martinez Armenta, Alejandro Mejia Castillo, Jose Dario Galeano Bazurto, Eric Gabriel Cardenas Arzola, Oscar Leonardo Martinez Pirona, Anthony Wuiliam Hernandez Guerrero, and Aslhy Javier Galeano Basurto are, per Treasury, charged in the USDC-NE with providing material support to TdA, bank fraud conspiracy, bank burglary conspiracy, and/or money laundering conspiracy.¹³ Treasury states Martinez Armenta transacted directly with Hector Rusthenford Guerrero Flores ("Nino Guerrero"), the now-deceased head of TdA, and that Martinez Pirona transacted with Venezuelan entertainer Jimena Romina Araya Navarro, previously designated by OFAC for supporting TdA.¹ Galeano Basurto was previously detained in the United States in 2017 on suspicion of manipulating ATMs.¹

Designated companies. Enigma Community, S. de R.L. de C.V. (Tlalnepantla de Baz, Mexico) was designated as owned or controlled by Martinez Pirona; Soluciones Integrales Toluca, S.A. de C.V. (Toluca, Mexico) as owned or controlled by Mejia Castillo.¹²

Juan Gabriel Rivas Nunez (aliases "Juancho," "Negro Juancho," Wilson Stalyn/Starling Aponte Rodriguez; DOB October 2, 1981; Venezuela) is described by Treasury as a high-ranking TdA leader directing gold mining, narcotics exporting, and violent crime across multiple South American countries.¹² He was indicted in the Southern District of Texas in December 2025 for providing material support to TdA.¹

Already convicted (context). Separately from the September 30 designations, three defendants have been sentenced in the District of Nebraska for roles in the conspiracy: Carlos Javier Padron (78 months) and Oddry Arnoldo Cabrera Torrealba (78 months), who each pleaded guilty to one count of conspiracy to commit bank burglary and one count of computer fraud and intentional damage to a protected computer and were ordered to jointly pay $1,537,696 in restitution; and Juan Manuel Gouveia Aguilera (96 months).⁴⁶

MITRE ATT&CK techniques (IDs verified live on attack.mitre.org):

OPSEC: The malware self-deletes after use to hinder detection and forensic review, and ships with anti-debugging and software-protection measures.⁴ Proceeds are laundered through cryptocurrency, with value settled largely in USDT on TRON and routed through exchange-hosted deposit addresses that obscure the end beneficiaries.³

Technical Indicators

threat_actor: Tren de Aragua (TdA)
malware_family: >
  Ploutus — ATM/ITM jackpotting malware; forces the cash-dispensing module to
  pay out without debiting an account, then deletes itself to conceal use.
sanctioned_tron_addresses:  # OFAC SDN List, added 2026-09-30; attributed by OFAC and TRM Labs
  - 'TJjRAn9kLiyh8h6gjBjaYjkfDkskgZfyW9'  # Anibal Alexander Canelon Aguirre ("Prometheus")
  - 'TCUmMCHQEbFFdGvfdg2LeS64QfzUKP2AgW'  # Eric Gabriel Cardenas Arzola (largest share, ~$2.1M)
  - 'THwbVuBBb26abe5TrAsYUpYz9mhWnBppdz'  # Jose Dario Galeano Bazurto
  - 'TBEmt7kPSwAv6NJTYKNdBVW524bUfPwJpJ'  # Anthony Wuiliam Hernandez Guerrero
  - 'TCifMAMwst3oEJx8GaNfqZw75dkFUa8vjG'  # Carlos Javier Martinez Armenta
  - 'TDxZ1XTZCmqkJJW2eJT362z6omRchJyGBX'  # Oscar Leonardo Martinez Pirona
  - 'TWJmTGhquvdp1jhBmgeGxBBwefteGZUQYW'  # Alejandro Mejia Castillo
network: >
  TRON (TRX); TRM reports settled value largely in USDT. All seven are
  exchange-hosted deposit addresses, so screen direct and indirect (1-2 hop)
  exposure; the holding exchange can likely identify the account holders.
host_artifacts:
  - Ploutus malware files deleted post-execution to conceal deployment (anti-forensics)
  - anti-debugging and software-protection packing to hinder reverse-engineering
file_hashes: none disclosed
ip_addresses: none disclosed
domains: none disclosed
note: >
  OFAC and DOJ did not publish Ploutus sample hashes or C2 infrastructure.
  Crypto addresses are reproduced verbatim as published on the OFAC SDN List and
  by TRM Labs; they are not network indicators and are not defanged, since any
  alteration would make them unusable for screening.

Legal and Regulatory Response

Sanctions. OFAC designated the network on September 30, 2026 pursuant to Executive Order 13581 (as amended) and Executive Order 13224 (as amended).¹ All property and interests in property of the designated persons within U.S. jurisdiction are blocked and must be reported; entities owned 50 percent or more by blocked persons are also blocked.¹ Because the designations invoke E.O. 13224, foreign financial institutions that knowingly facilitate "any significant transaction" for the designated persons risk secondary sanctions, including restrictions on U.S. correspondent or payable-through accounts.¹³ The action builds on OFAC's July 11, 2024 TCO designation, State's February 20, 2025 FTO designation, and OFAC actions on June 24, July 17, and December 3, 2025.¹

Criminal prosecution. The jackpotting conspiracy is prosecuted in the U.S. District Court for the District of Nebraska in conjunction with DOJ's Computer Crime and Intellectual Property Section and Joint Task Force Vulcan, with the FBI and HSI as lead investigative agencies.⁴⁶ DOJ stated on October 2, 2026 that 120 defendants had been charged in the District of Nebraska for roles in the conspiracy, that attacks had been targeted or carried out in 47 states, the District of Columbia, and several foreign nations, and that three defendants had been sentenced.⁴ Treasury, citing the period since October 21, 2025, put the count at 98 individuals indicted in ATM jackpotting schemes as of its September 30 release.¹ Rivas Nunez was charged in the Southern District of Texas in December 2025.¹

Manhunt. The FBI listed Canelon Aguirre on its Ten Most Wanted Fugitives list on March 13, 2026 with a reward of up to $1,000,000; DOJ announced his apprehension and return to the United States on October 2, 2026.⁴⁵ As of October 6, 2026, the FBI's public wanted poster for him had not yet been updated to reflect the arrest.⁵

Impact Assessment

• Confirmed: OFAC designated eight individuals, two Mexican companies, and Juan Gabriel Rivas Nunez, and added seven TRON addresses to the SDN List on September 30, 2026.¹²
• Confirmed: Three defendants have been sentenced in the District of Nebraska — Padron (78 months), Cabrera Torrealba (78 months), and Gouveia Aguilera (96 months); Padron and Cabrera Torrealba were ordered to pay $1,537,696 in restitution to victim banks.⁴⁶
• Reported (Treasury): $40.73 million in reported losses from alleged TdA jackpotting attacks in the United States across more than 1,500 attacks, as of August 2025.¹
• Reported (TRM Labs): approximately $6.1 million in total inflows to the seven designated addresses since March 2022 (not all tied to the scheme; the Cardenas Arzola address accounts for about $2.1 million), with onward flows of roughly $35 million to a Jorge Figueira-affiliated network.³
• Reported (DOJ): jackpotting attacks targeted or carried out in 47 states, the District of Columbia, and several foreign nations; 120 defendants charged in the District of Nebraska as of October 2, 2026.⁴
• Unknown: how much of the $40.73 million reported-loss figure is attributable specifically to the designated individuals, and how much value is ultimately recovered or forfeited.

Lessons and Defensive Recommendations

For SOC/defenders at banks and ATM/ITM operators:

• Treat unexpected cash-dispense events with no corresponding authorized transaction as a jackpotting indicator; alert on dispense commands issued outside the normal transaction switch.
• Harden the physical top-box of ATMs/ITMs and alarm on enclosure-open events, since the documented access vector is a physical break-in followed by local malware installation.¹
• Hunt for Ploutus-style anti-forensic behavior: binaries that delete themselves after execution and use software-protection packing or anti-debugging to resist analysis.⁴

For compliance, VASPs, and exchanges:

• Screen directly against the seven designated TRON addresses and review historical exposure; because they are exchange-hosted deposit addresses, the holding exchange can likely identify the underlying account holders and related accounts.³
• Extend screening to indirect exposure within one or two hops, as the designated addresses sent funds onward to other TdA-associated addresses.³

For leadership:

• Do not conflate a sanctions designation with a conviction, or Treasury's $40.73 million reported-loss figure with the roughly $6.1 million of on-chain inflows traced to the wallets — they count different things over different periods.¹³
• Recognize that ATM jackpotting is being treated by DOJ and Treasury as a terrorist-financing stream, which raises material-support and secondary-sanctions exposure for any institution in the payment or custody path.¹⁶

Sources