The **U.S. Treasury Department** has taken decisive action against a network of individuals associated with the Venezuelan criminal organization **Tren de Aragua (TdA)**, sanctioning eight members for their involvement in multi-million dollar ATM jackpotting schemes across the United States. ATM jackpotting involves criminals deploying specialized malware, such as **Ploutus**, **ATMii**, **ATMitch**, **GreenDispenser**, **Alice**, **RIPPER**, **Skimer**, and **SUCEFUL**, onto bank and credit union automated teller machines. This malicious software forces ATMs to dispense cash, often with evidence of the attack then deleted via an attached USB keyboard or the machine's built-in PIN pad. Among the sanctioned individuals is **Anibal Alexander Canelon Aguirre**, known as "**Prometheus**," who is alleged to have developed the **Ploutus** malware. **Aguirre** has been on the **FBI's Ten Most Wanted Fugitives list** since March. Six of his associates were also designated: **Eric Gabriel Cardenas Arzola**, **Jose Dario Galeano Bazurto**, **Anthony Wuiliam Hernandez Guerrero**, **Carlos Javier Martinez Armenta**, **Oscar Leonardo Martinez Pirona**, and **Alejandro Mejia Castillo**. "While **Prometheus's** network is based in Mexico and Venezuela, the scheme targets U.S.-based automated teller machines (ATMs), where criminals deploy malicious software (malware) to force ATMs to dispense cash. The stolen funds are then laundered and transferred to **TdA** members in various countries," stated the **Office of Foreign Assets Control (OFAC)**. This enforcement is part of a broader government effort, with over 30 actions taken against more than 300 individuals and entities tied to transnational criminal organizations since 2025. **TdA** was designated a Transnational Criminal Organization by the Treasury in July 2024 and a Foreign Terrorist Organization by the Department of State in February 2025.  According to **TRM Labs**, the Treasury also added seven **TRON** cryptocurrency addresses to its **Specially Designated Nationals and Blocked Persons List (SDN List)**. These addresses reportedly received approximately $6.1 million in total inflows since March 2022 and have sent funds to other **TdA**-associated addresses. **OFAC** estimates that, as of August 2025, **TdA** gang members have stolen $40.73 million from U.S. financial institutions across more than 1,500 alleged ATM jackpotting attacks. Since October 2025, the **U.S. Justice Department** has charged 98 suspects linked to the **TdA** gang and involved in these schemes, with potential prison terms ranging from 20 to 335 years each. Earlier this year, the **FBI** warned of a significant surge in ATM hacking incidents, with over $20 million stolen in 2025 alone, following a wave of arrests targeting **Tren de Aragua** members. Most recently, in early September, five Venezuelan nationals pleaded guilty after unsuccessful ATM jackpotting attempts in Wamego and Manhattan, Kansas.