WASHINGTON — September 30, 2026: The U.S. Treasury Department imposed blocking sanctions on 10 targets it says were connected to an international ATM-malware scheme that generated revenue for Tren de Aragua, a Venezuelan-origin organization the United States has designated as both a transnational criminal organization and a foreign terrorist organization.
The action is not a criminal conviction. It is an administrative sanctions measure by Treasury’s Office of Foreign Assets Control, or OFAC. Several of the people named have also been charged in federal court, but criminal allegations must be proved in court.
What Treasury announced
OFAC said the September 30 action covers a network based in Mexico and Venezuela that allegedly used “jackpotting” attacks against U.S. automated teller machines. In this type of attack, criminals physically access a machine, install or activate malicious software, and cause it to dispense cash without debiting a customer account.
Treasury said proceeds were moved through members and associates of Tren de Aragua, including through cryptocurrency transactions intended to obscure the source of the money. The department reported $40.73 million in alleged U.S. losses across more than 1,500 ATM-jackpotting attacks through August 2025. Those figures describe reported losses associated with this type of attack; they do not mean every incident has been finally adjudicated or tied to every person named in Wednesday’s action.
The department identified Anibal Alexander Canelon Aguirre, also known as “Prometheus,” as the alleged engineer of malware used in the attacks and said he is on the FBI’s Ten Most Wanted Fugitives list. OFAC also designated associates Carlos Javier Martinez Armenta, Alejandro Mejia Castillo, Jose Dario Galeano Bazurto, Eric Gabriel Cardenas Arzola, Oscar Leonardo Martinez Pirona, Anthony Wuiliam Hernandez Guerrero and Aslhy Javier Galeano Basurto.
Two Mexico-based businesses—Enigma Community, S. de R.L. de C.V. and Soluciones Integrales Toluca, S.A. de C.V.—were designated on ownership or control grounds tied to people in the alleged network. OFAC separately designated Juan Gabriel Rivas Nunez, also known as “Juancho,” whom Treasury described as a high-ranking Tren de Aragua leader involved in gold mining, narcotics exports and violent crime in South America.
What the sanctions do
Property and interests in property belonging to the designated parties that are in the United States, or under the possession or control of U.S. persons, are blocked and must be reported to OFAC. Entities owned 50% or more, directly or indirectly, by one or more blocked persons are also blocked even if not named separately.
U.S. persons generally may not transact with blocked persons unless an OFAC license or exemption applies. Treasury also warned that financial institutions and other parties can face sanctions exposure for certain dealings involving the designated network. OFAC’s rules can reach transactions that pass through the United States, not only transactions in which both parties are physically present in the country.
The designations were issued under two executive orders covering transnational criminal organizations and terrorism-related sanctions. Treasury said the action was coordinated through the Homeland Security Task Force with the FBI, Homeland Security Investigations, the Financial Crimes Enforcement Network, Justice Department units and the U.S. Attorney’s Office for the District of Nebraska.
The criminal-case context
Treasury said the Justice Department has indicted 98 people since October 21, 2025, over alleged involvement in ATM-jackpotting schemes. The named charges vary and include allegations of material support, bank burglary, computer offenses, bank fraud, money laundering and conspiracy.
That enforcement history is important context, but sanctions and indictments serve different purposes. OFAC restrictions can take effect when a person or entity is designated; an indictment starts a criminal case and does not establish guilt. Treasury also notes that sanctioned parties can petition for administrative removal from its lists.
An independent report by El País on September 30 described the designations and said the alleged network used malware to force U.S. ATMs to dispense cash before laundering funds for Tren de Aragua. The report also noted that the asset blocks and transaction prohibitions are immediate consequences of the OFAC action.
Why the action matters
The case connects three enforcement priorities—organized crime, cyber-enabled bank theft and sanctions compliance. For banks and payments firms, the immediate issue is screening customers and transactions against the updated OFAC list and assessing ownership links. For the public, Treasury’s announcement does not indicate that ordinary ATM users’ deposit accounts were directly debited by the malware method it described; the alleged attack targeted the machines’ cash-dispensing controls and financial institutions.
Readers can follow additional federal policy reporting in the AskNovus News section and international developments in World News.
Sources
- U.S. Department of the Treasury, September 30, 2026: OFAC designations and sanctions implications
- El País, September 30, 2026: independent report on the action
- U.S. Department of Justice, December 18, 2025: indictment background
Featured image: Eduardo Soares/Unsplash.
[…] For more verified federal enforcement coverage, visit Crime & Courts and Politics. AskNovus recently reported separately on Treasury sanctions tied to an alleged ATM-malware network. […]