Actor Profile

Tren de Aragua (TdA) is a Venezuelan transnational criminal organization designated by the U.S. Treasury as a Transnational Criminal Organization in July 2024 and by the State Department as a Foreign Terrorist Organization in February 2025. The gang operates a sophisticated financial crime network spanning Venezuela, Mexico, and the United States. Key figure Anibal Alexander Canelon Aguirre (alias "Prometheus"), an FBI Ten Most Wanted fugitive since March 2025, allegedly developed the Ploutus ATM malware. The organization's motivation is financial gain through coordinated ATM jackpotting operations, with stolen funds laundered via cryptocurrency (TRON addresses) and distributed to TdA members across multiple countries. The gang demonstrates advanced technical capabilities and operational coordination across international borders.

TTPs (Tactics, Techniques, Procedures)

TdA employs ATM jackpotting techniques involving physical access to automated teller machines to deploy malware including Ploutus (custom-developed), ATMii, ATMitch, GreenDispenser, Alice, RIPPER, Skimer, SUCEFUL, and other variants. Attack methodology includes: (1) gaining physical access to ATM hardware, (2) deploying malware via direct connection, (3) forcing cash dispensation through malicious commands executed via attached USB keyboards or built-in PIN pads, (4) deleting forensic evidence from compromised systems, and (5) laundering proceeds through cryptocurrency infrastructure, specifically TRON blockchain addresses. The operation demonstrates sophisticated money laundering tradecraft with approximately $6.1 million flowing through seven designated TRON addresses since March 2022. The campaign shows coordinated multi-jurisdictional execution with technical development occurring in Venezuela/Mexico while targeting U.S. financial infrastructure.

Targets & Patterns

TdA exclusively targets U.S.-based financial institutions, specifically banks and credit unions operating ATM networks. As of August 2025, the gang executed over 1,500 alleged ATM jackpotting attacks resulting in $40.73 million stolen from U.S. financial institutions. The targeting pattern shows nationwide scope across multiple states including documented incidents in Kansas (Wamego, Manhattan). The selection of ATM targets appears opportunistic but systematic, focusing on vulnerable machines that can be physically accessed for malware installation. The financial services sector is targeted due to the immediate cash-out potential and the gang's specialized technical capabilities in ATM exploitation. The scale of operations (1,500+ attacks) indicates either a large operational network or repeated targeting of multiple institutions by smaller cells.

Historical Context

TdA's ATM jackpotting campaign represents an escalation from traditional street-level criminal activity to sophisticated cyber-enabled financial crime. The U.S. government response has intensified significantly: Treasury designated TdA as a Transnational Criminal Organization in July 2024, followed by State Department designation as a Foreign Terrorist Organization in February 2025. The FBI issued warnings in February 2025 after criminals stole over $20 million that year, marking a massive surge in ATM hacking incidents. Since October 2025, the Justice Department has charged 98 TdA-linked suspects in ATM jackpotting schemes, with maximum sentences ranging from 20 to 335 years. The October 2026 OFAC sanctions against eight members, including Prometheus and six associates, represent the latest action in a sustained whole-of-government campaign that has resulted in over 30 actions against more than 300 individuals and entities tied to transnational criminal organizations since 2025. Recent prosecutions include five Venezuelan nationals pleading guilty in September 2026 to failed ATM jackpotting attempts in Kansas.

Defensive Recommendations

  • Implement physical security controls for ATM hardware including tamper-evident seals, locked enclosures, and video surveillance monitoring to detect unauthorized physical access attempts
  • Deploy application whitelisting and USB port controls on ATM systems to prevent execution of unauthorized malware such as Ploutus, ATMii, ATMitch, and related jackpotting tools
  • Enable comprehensive logging and SIEM integration for ATM systems to detect anomalous cash dispensation patterns, unauthorized software installation, or evidence deletion attempts
  • Conduct regular security assessments and firmware integrity checks on ATM fleets, prioritizing machines in high-risk locations or those showing signs of physical tampering
  • Monitor cryptocurrency transaction flows, particularly TRON blockchain addresses associated with known TdA infrastructure, and implement enhanced due diligence for large cash deposits following ATM servicing

---

# Geopolitical Context

Geopolitical Context

The Treasury Department's designation of eight Tren de Aragua members represents an escalation in the U.S. government's use of economic statecraft against transnational criminal organizations. The action follows TdA's designation as a Transnational Criminal Organization in July 2024 and as a Foreign Terrorist Organization in February 2025, signaling a shift toward treating organized cybercrime as a national security threat rather than purely a law enforcement matter. The targeting of Venezuela-based actors operating through Mexico reflects broader U.S. concerns about governance gaps in Latin America enabling criminal networks to project cyber-enabled financial crime into U.S. territory. The whole-of-government approach—combining Treasury sanctions, FBI investigations, and Justice Department prosecutions—mirrors frameworks previously applied to state-sponsored threat actors and terrorist financing networks.

State Actor Alignment

While Tren de Aragua operates as a non-state criminal enterprise, its base of operations in Venezuela and Mexico raises questions about permissive operating environments. The Treasury's action does not allege direct Venezuelan state sponsorship, but the gang's ability to conduct sustained, technically sophisticated operations from Venezuelan territory may indicate limited state capacity or willingness to disrupt such activities. The designation of TRON blockchain addresses and the identification of international money laundering networks suggest the group exploits jurisdictional arbitrage and cryptocurrency infrastructure to evade traditional financial controls. The U.S. response—over 30 actions against more than 300 individuals and entities tied to transnational criminal organizations since 2025—appears designed to impose costs on criminal networks that operate across weak governance zones, independent of formal state attribution.

Business Impacty pro region

The Tren de Aragua case illustrates how Latin American criminal organizations are increasingly adopting cyber capabilities to target U.S. financial infrastructure remotely. The estimated $40.73 million stolen across over 1,500 ATM jackpotting attacks as of August 2025 demonstrates significant operational scale and technical maturity. For European financial institutions, the precedent is concerning: malware families like Ploutus, ATMii, and others have historically migrated across regions, and criminal networks with proven capabilities in one jurisdiction often expand geographically. The Treasury's inclusion of cryptocurrency addresses on the SDN List—with approximately $6.1 million in inflows since March 2022—signals growing U.S. focus on blockchain-based money laundering, which has implications for global cryptocurrency exchanges and compliance frameworks. The designation may prompt increased information sharing between U.S. and allied financial regulators regarding ATM security vulnerabilities and transnational criminal finance patterns.

Forecast

If Tren de Aragua's leadership and technical infrastructure remain largely intact despite sanctions and arrests, the organization is likely to adapt its operational security and money laundering methods, potentially shifting to privacy-focused cryptocurrencies or alternative cash-out mechanisms. The arrest of 98 suspects since October 2025 may disrupt tactical operations in the near term, but the continued freedom of key figures like Anibal Alexander Canelon Aguirre ("Prometheus")—who remains on the FBI's Ten Most Wanted list—suggests the group's malware development capacity may persist. If U.S. financial institutions do not accelerate ATM security hardening and endpoint protection measures, jackpotting attacks are likely to continue at elevated levels. Should other transnational criminal organizations observe TdA's success in monetizing ATM malware, copycat operations may emerge in other regions with vulnerable legacy banking infrastructure. If international cooperation on extradition and asset recovery remains limited, sanctions alone are unlikely to fully neutralize the threat, and a sustained law enforcement campaign will be necessary to degrade the network's capabilities over the medium term.