Anibal Alexander Canelon Aguirre, identified as 'Prometheus,' is sanctioned by the US Treasury for allegedly engineering malware used in ATM jackpotting attacks associated with the Tren de Aragua (TdA) criminal group. The malware, Ploutus, is installed physically on victim ATMs after break-ins and remotely activated to bypass security and dispense cash. The network operates from Mexico and Venezuela, targeting US ATMs, laundering stolen funds including via cryptocurrency. The Treasury has designated multiple individuals, companies, and cryptocurrency addresses linked to this network, blocking their US assets and prohibiting transactions with US persons. The DOJ has indicted 119 individuals related to the conspiracy, with several already sentenced to prison terms.

The malware enables attackers to forcibly dispense cash from ATMs, resulting in significant financial losses exceeding $40 million in the US from over 1,500 jackpotting incidents. The criminal network's operations span multiple countries and involve laundering stolen funds through cryptocurrency, complicating law enforcement efforts. The sanctions and indictments disrupt the network's ability to operate financially and legally within the US jurisdiction.

The US government has imposed sanctions blocking property and prohibiting transactions with the blacklisted individuals, entities, and associated cryptocurrency addresses. Law enforcement continues to pursue indictments and prosecutions against network members. Organizations should ensure physical security of ATMs to prevent unauthorized access and monitor for signs of tampering. There is no direct software patch or fix for the malware itself, as the attack requires physical installation. Vigilance and cooperation with law enforcement remain key mitigations.