#ofac

OFAC sanctioned a Tren de Aragua ATM jackpotting network on September 30, 2026 — eight facilitators, two Mexican firms and seven TRON addresses — tied to $40.73M in reported US losses. Alleged malware engineer 'Prometheus' was arrested and arraigned in Nebraska two days later.

LockBit, BlackSuit and Play didn't run their own servers. They rented them from a company in St Petersburg that answered no abuse reports and no takedown requests, and billed like any other host.

Nobody was hacked. A Chinese CDN company bought the polyfill.io domain, and every site that had ever pasted the script tag started serving whatever the new owner wanted. Four months later it was redirecting phones to betting scams.