Security1 publisher2 min readPublished
Treasury sanctions 10 over Ploutus ATM jackpotting it ties to Tren de Aragua
Treasury's OFAC sanctioned 10 people over Ploutus ATM jackpotting, a scheme US officials tie to at least 1,500 attacks and $40.7 million in losses. Treasury calls the thefts a key revenue source for the Venezuelan criminal group Tren de Aragua.
The Watch · Security desk
What happened
- OFAC's designations cover several Venezuelan nationals and companies they control, all part of the effort to launder cash stolen from dozens of ATMs.
- The proceeds allegedly went to Tren de Aragua members who hid their origin through cryptocurrency or through companies they own in Mexico and other countries.
- The FBI has named Anibal Alexander Canelon Aguirre, now on its most wanted list, as the developer of the Ploutus malware.
- Treasury says it has photographs of Aguirre with proceeds of the jackpotting crimes.
- At least 98 people have been indicted in the scheme, and five men pleaded guilty to related charges last month.
Compiled by The WatchSomething wrong?How this is made
Why it matters
- contradiction Anyone treating this as a Tren de Aragua threat is relying on a government attribution that outside researchers have not corroborated.
- exposure Exchanges and firms that move money for the designated Venezuelans or the companies they control are now handling funds of OFAC-listed parties.
- capability Tracing jackpotting cash gives investigators a route into stablecoin laundering services that, per Chainalysis, also serve other Latin American criminal groups.
- cost Because the malware empties the machine, each successful hit costs the operator whatever cash that ATM was holding.
Ploutus needs physical access and a laptop. In videos and photos released by prosecutors and Treasury, men crack open the top of an ATM, link a laptop to it and install the malware [6]. The malware then forces the machine to dispense all of its available cash [7]. Aguirre is accused of sending multiple teams across the US to use it on ATMs typically located in remote areas [9].
The tool is mature. Experts and government agencies have warned about Ploutus variants for nearly a decade [12]. Google researchers called it "one of the most advanced ATM malware families" they had seen [13].
Across the tracked incidents, the loss averages about $27,000 per attack, or $40.7 million divided by 1,500 [1]. Both figures cover only the attacks US officials have tracked, and the attack count is a floor [3]. The Record's report does not describe any new requirement for banks or ATM operators [19].
Wednesday's designations target the laundering operation [c1, c2]. Chainalysis said jackpotting proceeds "flow through the same channels as drug trafficking money" [14]. The firm found that counterparties of the Tren de Aragua wallets had exposure to laundering operations used by Colombian and Mexican drug cartels, "as well as a Venezuelan national charged with laundering one billion dollars" [15]. "The network relied on shared laundering infrastructure, including stablecoins, that services multiple criminal organizations across Latin America," Chainalysis said [16].
The Justice Department has repeatedly claimed "extensive direct and indirect links" between Ploutus and Tren de Aragua [17]. Experts have not found any links between Ploutus and either Aguirre or the gang, The Record reported [18].
What to watch
- Technical evidence, from researchers or in court filings, that connects Ploutus samples to Aguirre or Tren de Aragua.
- Whether Aguirre is arrested and whether the 98 indictments go to trial with evidence on the laundering routes.
- Further OFAC designations aimed at the stablecoin laundering services Chainalysis says the network shared with cartels.