TdA ATM jackpotting: alleged Ploutus developer “Prometheus” (Canelon Aguirre) captured, pleads not guilty in Nebraska (2 Oct) — days after OFAC sanctions on his network (30 Sep)
US Treasury press release sb0640 (30 September 2026; OFAC Recent Actions same day; SecurityWeek amplify 1 Oct) sanctions Anibal Alexander Canelon Aguirre (a.k.a. “Prometheus” / “The Engineer”) — FBI Ten Most Wanted fugitive alleged to engineer malware used in Tren de Aragua (TdA) ATM jackpotting — plus seven associates and two Mexico-based companies (Enigma Community; Soluciones Integrales Toluca). Scheme: crews break into US ATMs, install malware (reporting names Ploutus), remotely force cash dispense; proceeds laundered including via TRON crypto addresses listed on SDN.
Treasury: as of August 2025, reported US jackpotting losses US$40.73M across 1,500+ attacks; DOJ has indicted 98 individuals since 21 Oct 2025 with material-support/bank-fraud/computer-intrusion charges (Nebraska and other districts). Designations under E.O. 13581 and E.O. 13224 (TdA is an FTO).
Primary: Treasury sb0640 / OFAC SDN update; wire: SecurityWeek 1 Oct; TRM Labs on TRON addresses.
UPDATE (DOJ, 2 Oct 2026): the Justice Department announced Canelon Aguirre has been apprehended and returned to the US; he made his initial appearance on 2 October before a magistrate judge in the District of Nebraska, entered not guilty pleas and remains detained pending trial. He was indicted there in December 2025 on conspiracy to commit bank fraud, conspiracy to commit money laundering, conspiracy to commit bank burglary and computer fraud, and conspiracy to provide material support to terrorists.
DOJ alleges he developed the Ploutus ATM malware, including anti-analysis and self-deletion components, and was a principal leader of the jackpotting conspiracy. He was the first cyber criminal added to the FBI Ten Most Wanted list (March 2026). BleepingComputer (5 Oct) cites court documents putting losses above US$5.4 million in at least 63 bank and 54 credit-union jackpottings between February 2024 and December 2025, plus about US$1.43 million attempted.
No Australian ATMs are named.
- Product
- ATM jackpotting malware / TdA financial network (Ploutus-class; OFAC SDN designations — not a product CVE)
- Versions
- n/a — sanctions / LE action (OFAC SDN add 30 Sep 2026; reporting 1 Oct 2026)
- Exploited in Australia?
- unknown
- Patch to
- No product CVE. AU banks/ATM operators: maintain ATM/ITM hardening (physical + endpoint allowlists, signed cash-dispense paths, network segmentation); monitor OFAC SDN/TRON address blocklists for laundering exposure; treat jackpotting as hybrid physical-cyber. Compliance: screen counterparties against SDN updates including Prometheus network entities.
- Primary: US Treasury — Sanctions TdA ATM jackpotting financial network / Prometheus (30 Sep 2026; sb0640)
- Vendor: OFAC Recent Actions — Counter Terrorism / TCO designations (release dated 30 Sep 2026)
- Source: US DOJ — Apprehended Tren de Aragua leader on FBI Top 10 Most Wanted list appears in Nebraska (2 Oct 2026)