CyberNew CyberNew
Ransomware & Malware The Record 2 weeks ago

US sanctions 10 over ATM malware scheme tied to Tren de Aragua

CN
CyberNew Threat Research Desk
• Original Reporting: The Record
CyberNew Threat Intel Assessment
Assessed Severity: MEDIUM
Impacted Surface
Enterprise Perimeter & Network Defense
Intelligence Sector
Ransomware & Malware

Analyst Takeaway

"Images showing suspects installing malware onto ATMs. Image: Treasury Department US sanctions 10 over ATM malware scheme tied to Tren de Aragua The Treasury Department sanctioned 10 people for their role in a lucrative scheme involving malware that allowed people to drain ATMs of their cash. Treasury’s Office of Foreign Assets Control (OFAC) targeted multiple Venezuelan nationals and several..."

Recommended Defense & Mitigation

  • Threat Monitoring: Ingest published IOCs into SIEM/EDR detection rules for continuous telemetry monitoring.
  • Security Awareness: Alert staff and maintain baseline endpoint hardening across endpoints.
Curated & Verified by CyberNew Threat Intelligence Desk Standard Defense Framework (NIST / MITRE ATT&CK)
atms
Images showing suspects installing malware onto ATMs. Image: Treasury Department

US sanctions 10 over ATM malware scheme tied to Tren de Aragua

The Treasury Department sanctioned 10 people for their role in a lucrative scheme involving malware that allowed people to drain ATMs of their cash.

Treasury’s Office of Foreign Assets Control (OFAC) targeted multiple Venezuelan nationals and several companies they control that are part of the effort to launder the money stolen from dozens of ATMs.

U.S. officials have tracked at least 1,500 of the attacks causing $40.7 million in losses. The sanctions tie the ATM jackpotting scheme to Tren de Aragua, a Venezuelan criminal group, and Treasury officials claim it is a “key source of revenue for the organization.”

The proceeds of ATM thefts were allegedly transferred to Tren de Aragua members who helped conceal their origin, either through cryptocurrency or by laundering the funds through companies they own in Mexico and other countries. 

The Justice Department has repeatedly claimed there are “extensive direct and indirect links” between the Ploutus malware used in the ATM jackpotting scheme and Tren de Aragua. 

Blockchain analysis firm Chainalysis said ATM jackpotting proceeds “flow through the same channels as drug trafficking money.”

Source Verification & Original Intelligence

This threat report was reviewed by CyberNew analysts and cross-referenced with primary security disclosures from The Record.

Primary Advisory →