U.S. sanctions 10 people tied to Tren de Aragua over Ploutus ATM malware jackpotting scheme

The U.S. sanctioned 10 people and associated companies for helping run and launder proceeds from a malware scheme that made ATMs spit out cash. Treasury says the operation used Ploutus ATM malware in at least 1,500 attacks causing $40.7 million in losses, and tied the proceeds to Tren de Aragua through cryptocurrency and company-based laundering networks in Mexico and elsewhere. U.S. officials say at least 98 people have been indicted, and the alleged Ploutus developer, Anibal Alexander Canelon Aguirre, remains wanted.

Why it matters: This is a long-running malware-driven theft campaign with major real-world losses and organized-crime links, so banks, ATM operators, and law enforcement should treat it as an active threat. Financial institutions should review ATM hardening, remote-access controls, physical access monitoring, and laundering indicators tied to crypto and cross-border shell companies.

Sources

Alleged ATM malware creator appears in Nebraska court after arrest

2026.10.06 92% relevant

This article updates the same underlying Ploutus ATM jackpotting campaign by reporting that alleged mastermind Anibal Alexander Canelon Aguirre has appeared in U.S. court after being apprehended, pleaded not guilty, and now faces charges tied to the long-running attacks and alleged Tren de Aragua links.

FBI Arrests ‘Most Wanted’ Developer of Ploutus ATM Malware

Ionut Arghire 2026.10.06 94% relevant

This updates the same underlying Ploutus/Tren de Aragua ATM jackpotting case by reporting the arrest and court appearance of alleged Ploutus developer and TdA leader Anibal Alexander Canelon Aguirre, who had just been sanctioned and was on the FBI's most wanted list.

Alleged dev of Ploutus ATM malware appears in US court after arrest

Sergiu Gatlan 2026.10.05 92% relevant

This article updates the same underlying U.S. government action against the Tren de Aragua-linked Ploutus ATM jackpotting operation by adding that alleged Ploutus developer Anibal Alexander Canelon Aguirre has now been arrested and appeared in U.S. court, along with details on losses, scope, and DOJ charges.

US sanctions Tren de Aragua gang members in ATM hacks crackdown

Sergiu Gatlan 2026.10.02 95% relevant

This article is a direct update on the same Treasury sanctions action against Tren de Aragua members tied to Ploutus-based ATM jackpotting, adding details on the eight sanctioned individuals, Prometheus's alleged role as the Ploutus developer, seven sanctioned TRON wallet addresses, and updated loss and charging figures.

US sanctions 10 over ATM malware scheme tied to Tren de Aragua

2026.09.30 100% relevant

This article establishes a distinct story because it centers on new U.S. sanctions against named people and companies in a specific Ploutus ATM jackpotting and laundering network linked by Treasury to Tren de Aragua.