The U.S. Treasury Department sanctioned 10 individuals and entities on Wednesday over a financial network linked to Tren de Aragua, targeting an alleged ATM “jackpotting” operation that stole millions of dollars from U.S. financial institutions. The Office of Foreign Assets Control said the action targets a network accused of using malicious software to force ATMs to dispense cash without authorized withdrawals.
The sanctions center on Anibal Alexander Canelon Aguirre, also known as “Prometheus,” an FBI Ten Most Wanted fugitive whom U.S. authorities accuse of developing malware used in the ATM attacks. Treasury also designated Juan Gabriel Rivas Nunez, known as “Juancho,” whom authorities identify as a senior Tren de Aragua figure involved in illegal gold mining, narcotics exports and other criminal activity.
The other targets tied to the jackpotting network include Carlos Javier Martinez Armenta, Alejandro Mejia Castillo, Jose Dario Galeano Bazurto, Eric Gabriel Cardenas Arzola, Oscar Leonardo Martinez Pirona, Anthony Wuiliam Hernandez Guerrero and Aslhy Javier Galeano Basurto. Treasury also designated two Mexico-based companies, Enigma Community, S. de R.L. de C.V. and Soluciones Integrales Toluca, S.A. de C.V., in connection with the network.
Federal authorities have previously documented the mechanics and financial impact of the scheme. The Justice Department said ATM jackpotting crews used malware known as Ploutus to command cash-dispensing modules and force machines to release currency without debiting legitimate accounts. According to federal data cited in connection with the Treasury action, reported losses from more than 1,500 U.S. jackpotting attacks totaled $40.73 million through August 2025.
The underlying investigation has already produced a substantial number of criminal cases. The Justice Department said in June that 98 additional defendants had been indicted since the arrests of two participants in the ATM conspiracy, with charges including material support for a designated foreign terrorist organization, bank burglary, money laundering and unauthorized access to protected computers. Two defendants previously sentenced in the case were ordered to pay a combined $1.54 million in restitution to victim banks.
The sanctions add a financial enforcement measure to the criminal investigation by blocking property and interests in property of designated persons that are in the United States or under the control of U.S. persons. U.S. persons are generally prohibited from conducting transactions with blocked targets, increasing the financial restrictions facing the network and businesses connected to it.
Treasury’s action also underscores the financial-system dimension of a broader federal campaign against Tren de Aragua. The Justice Department has said the organization developed financial crimes targeting U.S. financial institutions as an additional source of revenue, while investigators have traced jackpotting proceeds through networks involving cryptocurrency and transfers among associates.
The new designations therefore target not only alleged criminal activity at ATMs but also the financial infrastructure used to move and retain the proceeds. The Treasury action follows earlier federal prosecutions and sanctions against Tren de Aragua-linked figures, extending the government’s efforts to disrupt the group’s access to the U.S. financial system.
