CyberNew CyberNew
Ransomware & Malware Dark Reading 1 week ago

Venezuelan Cartel's Malware Honcho Nabbed for ATM Jackpotting

CN
CyberNew Threat Research Desk
• Original Reporting: Dark Reading
CyberNew Threat Intel Assessment
Assessed Severity: MEDIUM
Impacted Surface
Enterprise Perimeter & Network Defense
Intelligence Sector
Ransomware & Malware

Analyst Takeaway

"US authorities have arrested and arraigned a 50-year-old Venezuelan member of the Tren de Aragua (TdA) criminal cartel, Anibal Alexander Canelon Aguirre, on charges related to a "jackpotting" scheme that compromised ATMs with malware and caused them to dispense tens of thousands of dollars in cash. He allegedly then laundered the proceeds through Venezuelan, Mexican, and Colombian cryptocurrency..."

Recommended Defense & Mitigation

  • Threat Monitoring: Ingest published IOCs into SIEM/EDR detection rules for continuous telemetry monitoring.
  • Security Awareness: Alert staff and maintain baseline endpoint hardening across endpoints.
Curated & Verified by CyberNew Threat Intelligence Desk Standard Defense Framework (NIST / MITRE ATT&CK)

US authorities have arrested and arraigned a 50-year-old Venezuelan member of the Tren de Aragua (TdA) criminal cartel, Anibal Alexander Canelon Aguirre, on charges related to a "jackpotting" scheme that compromised ATMs with malware and caused them to dispense tens of thousands of dollars in cash. He allegedly then laundered the proceeds through Venezuelan, Mexican, and Colombian cryptocurrency networks, including the decentralized finance trading platform known as TRON.

The group, which is involved in drug trafficking, smuggling, kidnapping and ransoms, human trafficking, extortion, and other financially motivated activities, began as a prison gang but has evolved into a multinational criminal enterprise based mainly in Venezuela and Mexico. Cybercrime, experts say, is increasingly part of the cartel mix in general as a convenient and stealthy way of amassing capital to fund other nefarious activities.

Related:Warlock Ransomware Hits Large Spanish, Portuguese Orgs

"Tren de Aragua is using ATM malware as a terrorist financing tool, then moving the cash onto TRON so it looks like ordinary exchange deposits," Ari Redbord, global head of policy at TRM Labs, a blockchain analysis firm, tells Dark Reading. "That is the same playbook we keep seeing from foreign terrorist organizations (FTOs) with on-chain infrastructure."

A Cartel's Cybercrime Leader

Canelon Aguirre — also known as "Prometheus" and "The Engineer" — is a leader in the cartel, and the principal architect of the Ploutus-D malware used to compromise and control the ATMs targeted in the scheme, according to the US Attorney's Office for the District of Nebraska, which is spearheading prosecution of the group. Over the past two years, TdA hit cash machines in Latin and North America, with more than $5.1 million stolen from 117 banks and credit unions in the United States in 2024 and 2025, according to the original indictment of Canelon Aguirre and other members of the group. The TdA group is based in Mexico and Venezuela, but mostly targeted banks and credit unions in the United States.

"We are going after the entire jackpotting network, from ringleaders and malware developers to crews in the US," Eugene Kowel, a special agent in charge with the FBI's Omaha office, said in a statement announcing Canelon Aguirre's capture and arraignment. "We will continue to follow the money and surge resources to arrest and apprehend TdA members and leadership."

Source Verification & Original Intelligence

This threat report was reviewed by CyberNew analysts and cross-referenced with primary security disclosures from Dark Reading.

Primary Advisory →