1. Executive summary
The US Treasury Department's Office of Foreign Assets Control has sanctioned Anibal Alexander Canelon Aguirre, known as 'Prometheus', described by Treasury as the alleged engineer of the malware used in ATM jackpotting attacks, along with seven alleged associates and two Mexico-based companies. The designations include seven TRON cryptocurrency addresses linked to Prometheus and six associates, per blockchain intelligence firm TRM Labs. Treasury attributes the jackpotting campaign to Tren de Aragua and names Ploutus as the malware typically used; the group's network is based in Mexico and Venezuela and targets ATMs in the United States. Reported US losses from jackpotting reached more than $40 million across more than 1,500 attacks as of August 2025. No CVE, CVSS score, or CISA KEV entry is associated with this item, and MITRE ATT&CK holds no profile for Tren de Aragua, so the attribution to the group is unconfirmed at the level of tracked adversary infrastructure. The direct risk to EMEA financial services is sanctions exposure and correspondent-banking contagion rather than a new technical intrusion technique.
2. Regulatory framing
| Article | Trigger (the fact in this item) | Practical impact |
|---|---|---|
| DORA Art. 28: ICT third-party risk, general principles | OFAC designated two Mexico-based companies as part of Prometheus's network, and foreign financial institutions conducting significant transactions on behalf of designated parties risk secondary sanctions. | Clients must re-screen ICT third-party and vendor registers against the OFAC designation list, and assess whether any ATM servicing, cash-in-transit, or cash-handling supplier has a nexus to the designated entities. |
| DORA Art. 30: key contractual provisions with ICT third-party providers | The same designations create a contractual event: a counterparty can become a sanctioned party mid-term, which most ATM servicing and cash logistics contracts do not address. | Review termination, suspension, and audit rights in ATM servicing and cash-handling contracts to confirm they can be exercised on a sanctions designation without breach. |
| NIS2 Art. 21(2)(d): supply chain security measures | The designated network operates through third-party facilitators who physically access ATMs, which is a supply chain access path rather than a remote exploit. | Entities in scope must be able to evidence supply chain security measures covering physical and logical access by ATM servicing and cash-handling providers. |
DORA Art. 17, 18, 19, 24 and 29 and NIS2 Art. 23 are not engaged by this item: it describes a sanctions action and a criminal prosecution, not an ICT-related incident at a client, and no incident reporting obligation is triggered by a designation. UK NIS 2018 duties are not engaged on the facts given.
3. Technical analysis & attack chain
This is a law-enforcement and sanctions action, not a new intrusion report. The technical content below is Treasury's own description of the jackpotting method, as relayed by SecurityWeek, and it is single-sourced to that reporting.
- Criminal facilitators surveil candidate ATMs to select targets.
- Facilitators physically break into the ATM and install malware on the machine.
- The malware is activated remotely, which lets the facilitators bypass the ATM's security systems.
- Facilitators push a dispense command, forcing the ATM to dispense currency until it is empty or the operation is disrupted.
Treasury names Ploutus as the malware TdA typically uses. The source does not give Ploutus version numbers, file names, hashes, persistence mechanism, or command-and-control protocol, and none are reproduced here.
The financial trail is the part with operational relevance to banks. Stolen cash is laundered, including through cryptocurrency, and moved to TdA members in various countries. TRM Labs reports that the designations include seven TRON cryptocurrency addresses linked to Prometheus and six of his associates. The source does not publish the addresses themselves, so no on-chain indicators can be extracted from it.
Enforcement status: Canelon Aguirre was added in March to the FBI's Ten Most Wanted Fugitives list, the first person on that list wanted for cybercrimes. OFAC designated seven alleged associates alongside him, and all have been indicted in Nebraska on charges including providing material support to TdA, bank fraud conspiracy, bank burglary conspiracy, and money laundering conspiracy. The Justice Department has indicted 119 people in connection with the conspiracy. Sentencing to date: Oddry Arnoldo Cabrera Torrealba and Carlos Javier Padron each received 78 months in June; Juan Manuel Gouveia-Aguilera received 96 months in August, which the DOJ said is the longest federal sentence imposed for a role in ATM jackpotting.
Confidence caveats. The attribution of the jackpotting campaign to Tren de Aragua rests on US government statements relayed by a single outlet; MITRE ATT&CK holds no profile for the group, so no tracked tooling, infrastructure, or TTP set can be corroborated against it. The link between Prometheus and Ploutus is Treasury's allegation, not a technical finding reproduced in the source. The TRON address count is single-sourced to TRM Labs. Treat all three as unconfirmed pending independent corroboration.
4. Mitigation & containment
P1 within 24 hours
- Screen the OFAC designation list against your ATM estate, cash-in-transit providers, ATM servicing contractors, and any Mexico or Venezuela-linked counterparties. The two designated companies are not named in the source material available to us; pull the names from the OFAC release directly rather than from this advisory.
- Screen customer and counterparty transaction monitoring rules for the seven designated TRON addresses. The addresses are not published in the source; obtain them from the OFAC SDN entry and load them into blockchain analytics tooling.
- Confirm with your sanctions compliance function that foreign financial institution exposure has been assessed, given the secondary sanctions risk Treasury states for significant transactions on behalf of designated parties.
P2 within 72 hours
- Review physical ATM security controls against the four-step method above: surveillance of the machine before attack, physical break-in, remote activation, dispense command. Where ATMs sit in low-observation locations, confirm camera coverage and tamper alarms are functioning.
- Confirm ATM software integrity controls: top-box and cabinet locks, BIOS and boot integrity, and whether the estate enforces application allowlisting so an installed payload cannot execute.
- Check ATM cash replenishment limits and dispense thresholds against the loss pattern described, where a machine is drained until empty.
P3 within 7 days
- Add sanctions-designation and adverse-media screening to the periodic review of ATM servicing and cash-handling suppliers, and record the outcome in the third-party register.
- Confirm ATM servicing contracts carry suspension and termination rights exercisable on a sanctions designation without breach, per the DORA Art. 30 row above.
- Where Ploutus is in scope for your threat model, note that this advisory carries no Ploutus technical indicators. Any detection content must come from a vendor source that publishes them.
5. Indicators of compromise
No atomic indicators of compromise are available in the source material. The source names no hashes, domains, IP addresses, file paths, or registry keys, and it does not publish the seven TRON addresses it references.
Behavioural indicators
| behaviour | where to observe | confidence |
|---|---|---|
| Physical break-in to an ATM cabinet or top box before cash loss | ATM tamper alarms, branch CCTV, physical security logs | Medium; Treasury's description of the method, single-sourced |
| Remote activation of installed software on an ATM followed by a dispense command | ATM transaction logs, host-based process telemetry on the ATM, vendor management console | Medium; Treasury's description of the method, single-sourced |
| ATM drained to empty in a single operation rather than through normal withdrawal patterns | ATM cash reconciliation, dispense volume alerts | Medium; Treasury's description of the method, single-sourced |
| Cash proceeds laundered through cryptocurrency, including TRON | Blockchain analytics, correspondent payment monitoring | Medium; TRM Labs via the source, single-sourced |
6. Detection
Insufficient indicators to author detection rules. The source contains no file names, command-line flags, mutex names, registry keys, scheduled-task names, ransom-note text, or hard-coded values, and it does not publish the TRON addresses it references. The only named artefact is the malware family name Ploutus, which is not a threat artefact suitable for a detection string.
7. Sources
- SecurityWeek, Treasury Blacklists Most-Wanted ATM Malware Developer and His Network, https://www.securityweek.com/treasury-blacklists-most-wanted-atm-malware-developer-and-his-network/, 2026-10-01
8. Adverse Trace position
We assess this as a sanctions and enforcement item with no new technical exposure for EMEA financial services, and we are not raising severity on it. The material risk is sanctions contagion through ATM servicing, cash-in-transit, and correspondent relationships, plus the laundering channel through TRON, not a novel attack technique. The attribution to Tren de Aragua is unconfirmed: MITRE ATT&CK holds no profile for the group, and the Prometheus-to-Ploutus link is a Treasury allegation relayed by a single outlet, so we treat the technical detail as single-sourced and will not issue detection content on it. Next, we will pull the OFAC SDN entry to obtain the designated company names and the seven TRON addresses, since the source does not publish them, and we will re-issue this advisory with those indicators if they are usable. Clients with US-dollar correspondent exposure or Mexico and Venezuela-linked ATM servicing arrangements should treat the P1 screening steps as the priority.
Published via PulseTrace — Adverse Trace threat intelligence.