Threat Intel
US Treasury Sanctions Tren de Aragua Members Over ATM Jackpotting Attacks
The U.S. Treasury Department has sanctioned eight members of the Venezuelan Tren de Aragua gang for orchestrating ATM jackpotting attacks that stole millions from U.S. banks. The sanctions target individuals who deployed malware such as Ploutus to force ATMs to dispense cash and erase evidence. Defenders should update ATM firmware, monitor for known malware, and enforce network segmentation.
What happened
The U.S. Treasury Department imposed sanctions on eight members of the Venezuelan Tren de Aragua gang for orchestrating ATM jackpotting attacks that stole millions from U.S. banks.
Impact
These criminals deployed a suite of malware—including Ploutus, ATMii, ATMitch, GreenDispenser, Alice, RIPPER, Skimer, and SUCEFUL—to force ATMs to dispense cash and erase evidence. The attacks targeted ATMs across the United States, affecting banks, credit unions, and their customers.
“Prometheus’s network is based in Mexico and Venezuela, the scheme targets U.S.-based automated teller machines.”
Who is affected
Financial institutions operating ATMs in the U.S., as well as the Treasury’s sanctions list now includes Anibal Alexander Canelon Aguirre (“Prometheus”) and seven associates.
What defenders should do
- Verify that ATM firmware and management software are up to date and signed.
- Deploy endpoint detection on ATM control systems and monitor for known malware signatures.
- Implement strict network segmentation between ATM networks and corporate IT.
- Enable logging and forensic capabilities to detect abnormal cash dispensing or USB activity.
- Stay informed on Treasury sanctions and update threat intelligence feeds accordingly.
Related articles
ATM Malware Architect Appears in Nebraska Court After Arrest
Anibal Aguirre, the alleged mastermind behind the Ploutus ATM‑jackpotting malware, pleaded not guilty in a Nebraska court after his arrest in Venezuela. The case underscores the scale of ATM theft—over 1,500 attacks and $40.7 million in losses—and highlights the need for tighter ATM security. Defenders should review firmware integrity, physical access controls, and monitoring for malware signatures.
Read briefing
ClickFix Attacks: User-Executed Malicious Commands
ClickFix attacks rely on deceiving users into executing malicious commands, often via copy-pasted instructions. Defenders should focus on user awareness training and implement browser/endpoint security controls to prevent command execution. CrowdStrike Falcon offers layered protection against this technique.
Read briefing
NeedyMantis: Modular Post‑Compromise Malware Used in Targeted Attacks
Microsoft Threat Intelligence has identified NeedyMantis, a modular post‑compromise malware framework used to maintain long‑term access in targeted intrusions against telecoms, universities, medical nonprofits, intergovernmental organizations and government contractors. The malware, first seen in October 2025, combines custom loaders, encrypted archives and extensible components to evade analysis and support follow‑on operations. Defenders should monitor for its indicators, block its C2 domains, and apply Microsoft Defender detections.
Read briefing
CL-CRI-1171 PPI Marketplace Distributes Malware via YouTube Gaming Channels and SEO Funnel
A threat actor known as CL‑CRI‑1171 has operated a pay‑per‑install marketplace for two years, leveraging YouTube gaming channels and a search‑engine‑optimization funnel to deliver malware. The operation uses a custom loader, OfferLoader, to drop payloads such as Docro Hijacker, ARKTunnel, and the Insomnia RAT on corporate and critical infrastructure endpoints. Defenders should block malicious links, monitor for OfferLoader signatures, and ensure recent patches for known vulnerabilities are applied.
Read briefing