The U.S. Treasury Department has sanctioned Anibal Alexander Canelon Aguirre, the alleged developer of the Ploutus malware used to make ATMs spit out cash, along with associates, companies and cryptocurrency wallets tied to his network, SecurityWeek reported Thursday. Treasury says the scheme funneled money to Tren de Aragua, the Venezuelan gang that Washington has designated a terrorist organization.

What Happened

Treasury's Office of Foreign Assets Control announced the designations Sept. 30, according to The Record. Canelon Aguirre, who goes by the alias "Prometheus," is described by Treasury as the alleged engineer of the malware used in ATM jackpotting attacks.

Alongside him, OFAC designated seven of his associates, all of whom have been indicted in Nebraska, and two companies based in Mexico. SecurityWeek reported that seven TRON cryptocurrency addresses linked to Canelon Aguirre and six associates were also listed, citing blockchain analytics firm TRM Labs. The Record counted 10 designations in total.

RelatedSuspected Chinese Spies Exploited BeyondTrust Remote Support Flaw Since August, Google Says

The Nebraska indictment charges the associates with providing material support to Tren de Aragua and with conspiracies to commit bank fraud, bank burglary and money laundering.

Canelon Aguirre was added to the FBI's Ten Most Wanted Fugitives list in March 2026, the first person placed on the list for cybercrime.

How the Scheme Worked

Ploutus is designed to force an ATM to dispense its cash. According to SecurityWeek, crews surveilled target machines, installed the malware, then activated it remotely to bypass the ATM's security and keep it dispensing cash until the machine was empty or the operation was interrupted.

U.S. officials have tallied more than 1,500 attacks and about $40.7 million in losses as of August 2025. The network was run from Mexico and Venezuela, targeted machines in the United States and sent proceeds to Tren de Aragua members in several countries, with money moved through cryptocurrency and through companies in Mexico and elsewhere.

Blockchain analysis firm Chainalysis told The Record that jackpotting proceeds flow through the same channels as drug money, with exposure to laundering operations tied to Colombian and Mexican cartels.

Why It Matters

The action ties a piece of financially motivated malware directly to a group the U.S. treats as a terrorist organization, which lets prosecutors bring material-support charges alongside ordinary fraud counts. Sanctions also block any assets the targets hold under U.S. jurisdiction and expose banks, exchanges and other parties that deal with them to penalties.

The criminal cases are already producing long sentences. Two Venezuelan nationals, Oddry Arnoldo Cabrera Torrealba and Carlos Javier Padron, each received 78 months in June. Juan Manuel Gouveia-Aguilera was sentenced to 96 months in August, which SecurityWeek described as the longest federal sentence yet for a role in ATM jackpotting.

Accounts differ on the scale of the prosecution. SecurityWeek reported that the Justice Department has charged 119 people in the conspiracy, while The Record put the number of indicted people at 98 and said five men pleaded guilty last month.

What to Watch

Canelon Aguirre remains a fugitive, and the sanctions add financial pressure without putting him in custody. Watch whether exchanges and stablecoin issuers freeze funds at the listed TRON addresses, whether more associates are charged or extradited, and whether banks and ATM operators report a drop in jackpotting after the network's alleged engineer was named publicly.