The US Treasury has blacklisted the man it calls the developer behind the ATM jackpotting malware used by Tren de Aragua, together with seven associates and two companies operating from Mexico.
Anibal Alexander Canelon Aguirre goes by the handle “Prometheus.” Treasury describes him as the author of the code driving the cash-dispensing attacks. In March, the FBI added him to its Ten Most Wanted Fugitives list, making him the first person sought on that roster for cybercrimes. Tren de Aragua typically deploys malware named Ploutus.
The group’s crews work out of Mexico and Venezuela and strike machines inside the United States. Treasury laid out the routine: a crew watches an ATM, forces it open, loads the malware, then triggers it from a distance to defeat the machine’s safeguards and push out cash until the vault empties.
Crews then push the takings through laundering channels, cryptocurrency among them, and pass them to members spread across many countries. Treasury said reported jackpotting losses nationwide had topped $40 million by August 2025, drawn from more than 1,500 attacks.
TRM Labs, the blockchain tracking firm, counts seven TRON cryptocurrency addresses tied to Prometheus among the sanctioned targets, plus six associates. US persons are now barred from dealing with the named parties, and foreign banks that handle significant transactions for them risk secondary sanctions. All seven associates have been indicted in Nebraska. Charges tied to the jackpotting conspiracy now name 119 people, brought by the Justice Department, and some sentences have reached 96 months.
