ATM ‘Jackpotting’: How Malware Empties Machines—and Who OFAC Sanctioned Over a $40 Million Spree

Published Oct. 1, 2026. Case statuses are current as of that date.

Update, Oct. 5, 2026: Anibal Alexander Canelon Aguirre is no longer a fugitive. The Justice Department announced Oct. 2, 2026, that he had been apprehended and returned to the United States; he made his initial appearance in federal court in Nebraska on Oct. 2, pleaded not guilty to all four counts, and will remain detained pending trial [3]. He is presumed innocent.

On Sept. 30, 2026, the U.S. Treasury’s Office of Foreign Assets Control (OFAC) designated targets in a Tren de Aragua (TdA) fraud network that uses malware to force ATMs to spit out cash—“jackpotting”—then launders the proceeds, including through cryptocurrency [1]. Treasury said reported U.S. losses from alleged ATM jackpotting totaled $40.73 million across more than 1,500 attacks as of August 2025 [1].

Among those designated is Anibal Alexander Canelon Aguirre (aka “Prometheus”), whom Treasury describes as the alleged engineer of the malware used in the attacks and an FBI Ten Most Wanted fugitive indicted in the District of Nebraska [1].

Update, Oct. 5, 2026: The Justice Department said Oct. 2 that Canelon Aguirre, 50, of Venezuela, had been apprehended and was "back in the United States to face justice." He was indicted by a federal grand jury in the District of Nebraska in December 2025 on four counts: conspiracy to commit bank fraud; conspiracy to commit bank burglary and fraud in connection with computers; conspiracy to commit money laundering; and conspiracy to provide material support to terrorists. At his initial appearance on Oct. 2 before U.S. Magistrate Judge Michael D. Nelson, he entered not guilty pleas to all counts and was ordered to remain detained pending trial. DOJ alleges he developed the Ploutus malware and was one of the principal leaders of the ATM jackpotting conspiracy; DOJ said 120 defendants have been charged in the District of Nebraska in the conspiracy to date [3]. An indictment is an allegation, and he is presumed innocent unless proven guilty.

Important: Sanctions designations and indictments are not the same as convictions. Individuals who have been charged remain presumed innocent unless and until proven guilty. OFAC designations freeze U.S. property and restrict transactions; they are not criminal verdicts.

How jackpotting works

According to Treasury [1]:

1. Surveil ATMs, often in remote locations.
2. Break in and install malware on the machine.
3. Activate remotely to bypass security systems.
4. Dispense cash on command until the ATM is empty or the operation is disrupted.
5. Launder proceeds among organization members, including via crypto and companies in Mexico and elsewhere.

The Record reported that prosecutors and Treasury shared photos and video of suspects opening ATMs and connecting laptops, and that DOJ has linked the Ploutus malware family to the scheme; Chainalysis said jackpotting proceeds can flow through channels also used for drug-trafficking money [2]. The Record also noted that independent experts have not publicly confirmed links between Ploutus and Aguirre or TdA [2].

Treasury said that since Oct. 21, 2025, DOJ has indicted 98 individuals for roles in ATM jackpotting schemes, with charges that can include material support to a designated foreign terrorist organization, bank burglary, money laundering, computer intrusion, and bank fraud [1].

Who was sanctioned (named individuals)

OFAC’s Sept. 30 action named, among others [1]:

• Anibal Alexander Canelon Aguirre (aka Prometheus) — alleged malware engineer; FBI Ten Most Wanted; indicted in D. Neb. (Update, Oct. 5, 2026: apprehended; pleaded not guilty Oct. 2; detained pending trial [3].)
• Carlos Javier Martinez Armenta
• Alejandro Mejia Castillo (owner of Soluciones Integrales Toluca, S.A. de C.V.)
• Jose Dario Galeano Bazurto
• Eric Gabriel Cardenas Arzola
• Oscar Leonardo Martinez Pirona (owns Enigma Community, S. de R.L. de C.V.)
• Anthony Wuiliam Hernandez Guerrero
• Aslhy Javier Galeano Basurto — also indicted in D. Neb.; previously detained in the U.S. on suspicion of manipulating ATMs
• Juan Gabriel Rivas Nunez (aka Juancho) — described as a high-ranking TdA leader; separate indictment in S.D. Tex. related to material support (gold mining and other activities)

Several associates are described as indicted in Nebraska on charges including material support to TdA, bank fraud conspiracy, bank burglary conspiracy, and/or money laundering conspiracy [1].

U.S. persons generally may not deal in property of designated persons; violations can bring civil or criminal penalties [1].

Red flags for banks and the public

• ATMs with pry marks, loose fascia, or unexpected out-of-service periods.
• Unusual late-night service activity without bank authorization.
• Crypto wallets or money mules suddenly moving large cash-linked balances.
• For consumers: skimming is different from jackpotting, but both warrant reporting damaged or odd ATMs to the bank immediately.

What to do if you're affected

1. Banks and credit unions: Follow FFIEC and network guidance on ATM physical security and malware monitoring; report incidents to law enforcement and FinCEN as required.
2. Consumers: Use well-lit, indoor ATMs when possible; if a machine looks tampered with, walk away and notify the bank.
3. Businesses: Do not provide services to parties you know are sanctioned; screen against OFAC’s SDN list.
4. Tips on sanctions violations may qualify for FinCEN whistleblower awards in large cases [1].

Case status (as of Oct. 5, 2026)

Table updated Oct. 5, 2026; originally published as of Oct. 1, 2026.

Subject	Forum	Status as of Oct. 5, 2026	Source
Anibal Alexander Canelon Aguirre (Prometheus)	OFAC SDN; D. Neb. indictment (4 conspiracy counts)	Sanctioned Sept. 30, 2026; apprehended and returned to U.S.; pleaded not guilty Oct. 2, 2026; detained pending trial; presumed innocent. (As of Oct. 1: fugitive on FBI Ten Most Wanted list.)	[1], [2], [3]
Martinez Armenta; Mejia Castillo; Galeano Bazurto; Cardenas Arzola; Martinez Pirona; Hernandez Guerrero; Galeano Basurto	OFAC; several indicted D. Neb.	Sanctioned; charges alleged	[1]
Juan Gabriel Rivas Nunez (Juancho)	OFAC; S.D. Tex. indictment (material support)	Sanctioned	[1]

Those not convicted are presumed innocent. Statuses can change.

Sources

1. U.S. Department of the Treasury, “Treasury Sanctions Financial Network of Foreign Terrorist Organization, Tren de Aragua, After Theft of Millions from U.S. Banks,” Sept. 30, 2026. https://home.treasury.gov/news/press-releases/sb0640
2. Jonathan Greig, “US sanctions 10 over ATM malware scheme tied to Tren de Aragua,” The Record (Recorded Future News), Sept. 30, 2026. https://therecord.media/us-sanctions-10-atm-jackpotting-tren-de-aragua
3. U.S. Department of Justice, Office of Public Affairs, “Apprehended Venezuelan Tren de Aragua Leader on FBI’s 10 Most Wanted Fugitives List Appears in Nebraska Court Following Homeland Security Task Force Investigation,” Oct. 2, 2026. https://www.justice.gov/opa/pr/apprehended-venezuelan-tren-de-aragua-leader-fbis-top-10-most-wanted-list-appears-nebraska

---

Corrections and updates: If you are named in this article, or represent someone who is, and believe anything here is inaccurate or out of date (including a dismissal, acquittal, or change in case status), please contact us at editorandchief@scammers.com. We will review it and update the article promptly.