OFAC (30 Sep): sanctions TdA ATM jackpotting network — “Prometheus” (Canelon Aguirre) + associates; ~US$40.7M / 1,500+ US ATM hits
US Treasury press release sb0640 (30 September 2026; OFAC Recent Actions same day; SecurityWeek amplify 1 Oct) sanctions Anibal Alexander Canelon Aguirre (a.k.a. “Prometheus” / “The Engineer”) — FBI Ten Most Wanted fugitive alleged to engineer malware used in Tren de Aragua (TdA) ATM jackpotting — plus seven associates and two Mexico-based companies (Enigma Community; Soluciones Integrales Toluca). Scheme: crews break into US ATMs, install malware (reporting names Ploutus), remotely force cash dispense; proceeds laundered including via TRON crypto addresses listed on SDN. Treasury: as of August 2025, reported US jackpotting losses US$40.73M across 1,500+ attacks; DOJ has indicted 98 individuals since 21 Oct 2025 with material-support/bank-fraud/computer-intrusion charges (Nebraska and other districts). Designations under E.O. 13581 and E.O. 13224 (TdA is an FTO). Primary: Treasury sb0640 / OFAC SDN update; wire: SecurityWeek 1 Oct; TRM Labs on TRON addresses.
- Product
- ATM jackpotting malware / TdA financial network (Ploutus-class; OFAC SDN designations — not a product CVE)
- Versions
- n/a — sanctions / LE action (OFAC SDN add 30 Sep 2026; reporting 1 Oct 2026)
- Exploited in Australia?
- unknown
- Patch to
- No product CVE. AU banks/ATM operators: maintain ATM/ITM hardening (physical + endpoint allowlists, signed cash-dispense paths, network segmentation); monitor OFAC SDN/TRON address blocklists for laundering exposure; treat jackpotting as hybrid physical-cyber. Compliance: screen counterparties against SDN updates including Prometheus network entities.
Primary: US Treasury — Sanctions TdA ATM jackpotting financial network / Prometheus (30 Sep 2026; sb0640) · Vendor: OFAC Recent Actions — Counter Terrorism / TCO designations (release dated 30 Sep 2026) · SecurityWeek — Treasury blacklists ATM malware developer Prometheus / TdA network (1 Oct 2026)