The US Treasury's OFAC sanctioned 10 people and several companies tied to a Tren de Aragua ATM jackpotting scheme. Officials say the malware attacks, which forced ATMs to dispense cash, caused $40.7 million in losses across at least 1,500 incidents. The sanctions describe the scheme as a "key source of revenue" for the Venezuelan criminal group.
According to the Treasury, the stolen funds were laundered through cryptocurrency or companies in Mexico and other countries. Chainalysis found that wallets associated with Tren de Aragua had exposure to laundering operations used by Colombian and Mexican drug cartels, and that the network relied on shared infrastructure, including stablecoins, serving multiple criminal organizations.
The FBI has identified Anibal Alexander Canelon Aguirre as the developer of the Ploutus malware and added him to its most wanted list. However, the article notes that experts have not found links between Ploutus and Aguirre or Tren de Aragua, and that the Justice Department has repeatedly claimed "extensive direct and indirect links" between the malware and the gang. At least 98 people have been indicted and five pleaded guilty last month.