The United States Treasury Department has imposed sanctions on an alleged cybercriminal responsible for crafting malware used in ATM jackpotting incidents. This individual, linked to the Tren de Aragua (TdA) gang, and his network, including two companies in Mexico, have been targeted in this crackdown.
The Hunt for ‘Prometheus’
Identified as Anibal Alexander Canelon Aguirre, or ‘Prometheus’, this individual was placed on the FBI’s Ten Most Wanted Fugitives list in March, marking a first for someone wanted due to cybercrimes. The Treasury Department identifies him as the supposed creator of malware utilized in ATM jackpotting, specifically citing the Ploutus malware often employed by TdA operatives.
The network operates from Mexico and Venezuela, primarily targeting ATMs in the United States. The illicitly obtained funds are then laundered, sometimes through cryptocurrency, and distributed to TdA members across different nations.
Details of the Cyber Attacks
The Treasury Department explains the modus operandi: criminals surveil potential ATMs, then physically breach them to install malware. This malware is remotely activated, bypassing ATM security safeguards, and a command is executed to dispense cash until the ATM is emptied or the operation is halted.
By August 2025, over 1,500 jackpotting attacks were reported in the US, causing more than $40 million in losses, according to the Treasury Department.
Legal Actions and Implications
Aside from ‘Prometheus’, seven of his alleged associates have been sanctioned by the Office of Foreign Assets Control (OFAC). These individuals face charges in Nebraska, including supporting TdA operations, conspiracy for bank fraud and burglary, and money laundering.
Blockchain intelligence firm TRM Labs has identified seven TRON cryptocurrency addresses associated with ‘Prometheus’ and his network. The US has now frozen any assets these individuals and entities possess within the country, prohibiting US citizens from engaging in transactions with them. Foreign financial entities conducting significant transactions on their behalf may face secondary sanctions.
The Department of Justice has charged 119 individuals in connection to this ATM jackpotting scheme. Sentences have been handed down, including 78-month terms for Venezuelans Oddry Arnoldo Cabrera Torrealba and Carlos Javier Padron, and a 96-month sentence for Juan Manuel Gouveia-Aguilera, the longest in federal history for ATM jackpotting involvement.
This extensive operation underscores the US government’s commitment to combating international cybercrime and safeguarding financial systems from sophisticated attacks.
