The U.S. Department of the Treasury’s Office of Foreign Assets Control (OFAC) designated, on September 30, 10 targets involved in a Tren de Aragua (TdA) fraud scheme that has become a key source of revenue for the organization. TdA is a Foreign Terrorist Organization (FTO) responsible for violent and exploitative criminal activity across the Western Hemisphere—including drug trafficking, human trafficking, extortion, and murder-for-hire—making the disruption of its financial networks essential to protecting Americans. This operation is orchestrated by one of the FBI’s ten most-wanted fugitives, Anibal Alexander Canelon Aguirre (aka “Prometheus”). In addition to this network, OFAC also designated Juan Gabriel Rivas Nunez (aka “Juancho”), a high ranking TdA leader directing operations in multiple South American countries.
“President Trump’s administration will not allow terrorist organizations like Tren de Aragua to exploit the U.S. financial system or enrich themselves through theft and other criminal activity targeting American individuals and businesses,” said Secretary of the Treasury Scott Bessent.
While Prometheus’s network is based in Mexico and Venezuela, the scheme targets U.S.-based automated teller machines, where criminals deploy malicious software (malware) to force ATMs to dispense cash. The stolen funds are then laundered and transferred to TdA members in various countries. Through this scheme, TdA has siphoned funds from U.S. financial institutions. OFAC also designated a TdA leader involved in illicit gold mining operations. These actions form part of a sustained, whole-of-government campaign that has resulted in over 30 actions against more than 300 individuals and entities tied to transnational criminal organizations since 2025, reflecting the Administration’s commitment to dismantling the financial and operational infrastructure of groups like TdA.
In keeping with President Trump’s pledge to eliminate drug cartels and transnational criminal organizations, OFAC has prioritized targeting these and other criminal groups that threaten the welfare of Americans, in close coordination with the Homeland Security Task Force (HSTF).
A “jackpotting” attack refers to a type of cyberattack wherein criminals exploit vulnerabilities in ATMs and/or interactive teller machines (ITMs) of financial institutions by using malware that forces the ATMs or ITMs to dispense cash without debiting an account. TdA has used ATM jackpotting in the United States to steal millions of dollars from financial institutions. As of August 2025, reported losses from alleged ATM jackpotting attacks in the United States total $40.73 million across over 1,500 attacks.
Carlos Javier Martinez Armenta, Alejandro Mejia Castillo, Jose Dario Galeano Bazurto, Eric Gabriel Cardenas Arzola, Oscar Leonardo Martinez Pirona, and Anthony Wuiliam Hernandez Guerrero are associates of Prometheus who are also indicted for their involvement in the TdA ATM jackpotting scheme.
“Working alongside our law enforcement partners,” said Secretary Bessent, “we will continue to use all tools available to deny these terrorist financial facilitators the resources they need to operate, weakening their overall criminal enterprise and protecting the integrity of the U.S. economy.”