By PAUL O’DONOGHUE, Senior Correspondent
THE US Treasury has sanctioned 10 individuals and entities linked to Venezuela’s Tren de Aragua (TdA) gang over an alleged ATM “jackpotting” scheme.
Treasury said criminals used malware to force US ATMs to dispense cash. The stolen funds then moved among TdA members and associates in several countries, including through cryptocurrency transactions that helped conceal their origins.
The department said TdA had “siphoned funds from U.S. financial institutions” through the scheme. It said that, as of August 2025, “reported losses from alleged ATM jackpotting attacks in the United States total $40.73 million across over 1,500 attacks”.
The operation allegedly began under the direction of FBI Ten Most Wanted fugitive Anibal Alexander Canelon Aguirre, also known as “Prometheus”.
“Prometheus is the alleged engineer of the malware used in ATM jackpotting attacks and has been photographed posing with proceeds of the crime,” the Treasury said.
ATM jackpotting
The department said the latest action forms part of a “sustained, whole-of-government campaign” against transnational criminal organisations. It said the campaign has resulted in more than 30 actions against over 300 individuals and entities since 2025.
Treasury said it uses a “network-based approach” to disrupt different parts of terrorist organisations, including “leadership and key organizational nodes”, facilitators and front companies.
The latest action follows previous US sanctions against TdA’s leadership. In July 2025, Treasury sanctioned gang leader Hector Rusthenford Guerrero Flores, known as “Nino Guerrero”, and five other senior leaders and affiliates over alleged involvement in drug trafficking, human trafficking and money laundering.
Among those sanctioned in the latest action was Juan Gabriel Rivas Nunez, known as “Juancho”. Treasury described him as a high-ranking TdA leader who directs operations across several South American countries.
Treasury also sanctioned several alleged associates of Canelon and two Mexico-based companies linked to the network. The department said TdA members transferred ATM proceeds within the organisation to conceal their “illicit origins”.
The State Department designated TdA as a foreign terrorist organisation in February 2025. Treasury had previously designated the gang as a transnational criminal organisation in July 2024.
We hope you enjoyed reading this article
If you would like unlimited access to AML Intelligence premium articles, newsletter delivered twice a week, access to our Global Bank Fines and Penalties database, free access to Boardroom Series events and much more, select one of our subscription options and become a subscriber!
