Treasury Sanctions Financial Network of Foreign Terrorist Organization, Tren de Aragua, After Theft of Millions from U.S. Banks

WASHINGTON—Today, the U.S. Department of the Treasury’s Office of Foreign Assets Control (OFAC) designated 10 targets involved in a Tren de Aragua (TdA) fraud scheme that has become a key source of revenue for the organization. TdA is a Foreign Terrorist Organization (FTO) responsible for violent and exploitative criminal activity across the Western Hemisphere—including drug trafficking, human trafficking, extortion, and murder-for-hire—making the disruption of its financial networks essential to protecting Americans. This operation is orchestrated by one of the FBI’s ten most-wanted fugitives, Anibal Alexander Canelon Aguirre (aka “Prometheus”). In addition to this network, today OFAC also designated Juan Gabriel Rivas Nunez (aka “Juancho”), a high ranking TdA leader directing operations in multiple South American countries.

“President Trump’s administration will not allow terrorist organizations like Tren de Aragua to exploit the U.S. financial system or enrich themselves through theft and other criminal activity targeting American individuals and businesses,” said Secretary of the Treasury Scott Bessent. “Working alongside our law enforcement partners, we will continue to use all tools available to deny these terrorist financial facilitators the resources they need to operate, weakening their overall criminal enterprise and protecting the integrity of the U.S. economy.”

While Prometheus’s network is based in Mexico and Venezuela, the scheme targets U.S.-based automated teller machines (ATMs), where criminals deploy malicious software (malware) to force ATMs to dispense cash. The stolen funds are then laundered and transferred to TdA members in various countries. Through this scheme, TdA has siphoned funds from U.S. financial institutions. OFAC also designated today a TdA leader involved in illicit gold mining operations. These actions form part of a sustained, whole-of-government campaign that has resulted in over 30 actions against more than 300 individuals and entities tied to transnational criminal organizations since 2025, reflecting the Administration’s commitment to dismantling the financial and operational infrastructure of groups like TdA.

Today’s action is being taken pursuant to Executive Order (E.O.) 13581, as amended, and E.O. 13224, as amended, and builds on OFAC’s actions on June 24, 2025, July 17, 2025, and December 3, 2025 targeting the organization, its leadership, and key support networks. The U.S. Department of State identified TdA as an FTO on February 20, 2025; OFAC sanctioned TdA as a Transnational Criminal Organization on July 11, 2024.

TREN DE ARAGUA (TdA)

TdA is an FTO that originated in Venezuela and has expanded throughout the Western Hemisphere. TdA engages in a range of criminal activities, including drug trafficking, immigrant smuggling and human trafficking, extortion, sexual exploitation of women and children, money laundering, and murder-for-hire, among others.

In keeping with President Trump’s pledge to eliminate drug cartels and transnational criminal organizations, OFAC has prioritized targeting these and other criminal groups that threaten the welfare of Americans, in close coordination with the Homeland Security Task Force (HSTF). OFAC uses a network-based approach to simultaneously disrupt as many different facets of the FTOs as possible, from their leadership and key organizational nodes to facilitators and enablers, such as corrupt officials, complicit family members, and ostensibly legitimate front companies.

Today’s action is an HSTF-coordinated investigation involving the FBI and HSI and collaboration with the Financial Crimes Enforcement Network (FinCEN), U.S. Department of Justice (DOJ)’s Joint Task Force Vulcan (JTFV) and Computer Crime and Intellectual Property Section, and the U.S. District Attorney’s Office for the District of Nebraska.

JTFV was created in 2019 to eradicate MS-13 and has now expanded to target TdA. JTFV is comprised of U.S. Attorney’s Offices across the country, including Southern and Eastern Districts of New York; Eastern and Western Districts of North Carolina; Eastern and Western Districts of Virginia; Middle and Southern Districts of Florida; Eastern District of Texas; Western District of Oklahoma; Northern District of Indiana; District of Nevada; and the District of Arizona, as well as the Executive Office for U.S. Attorneys, and the Department of Justice’s National Security Division, Criminal Division, and the Office of Judicial Attaché and DEA partners in Bogotá, Colombia. Additionally, the FBI, DEA, HSI, ATF, USMS, and the Federal Bureau of Prisons are essential law enforcement partners with JTFV.

JACKPOT JUSTICE: TdA ATM JACKPOTTING EXPOSED

A “jackpotting” attack refers to a type of cyberattack wherein criminals exploit vulnerabilities in ATMs and/or interactive teller machines (ITMs) of financial institutions by using malware that forces the ATMs or ITMs to dispense cash without debiting an account. A jackpotting attack can involve several phases. Typically, after surveilling potential victim ATMs, criminal facilitators break into victim ATMs and install malware. The malware is then activated remotely, which allows criminal facilitators to bypass the ATM’s security systems. Finally, criminal facilitators push a dispense command, forcing the ATM to dispense its currency until the machine runs out of cash or until the operation is otherwise disrupted.

The ATM jackpotting proceeds are transferred within TdA among members and associates of their organization to conceal the illicit origins of the cash. Among other methods, the network designated today uses cryptocurrency transactions to launder proceeds of ATM jackpotting.

TdA has used ATM jackpotting in the United States to steal millions of dollars from financial institutions. As of August 2025, reported losses from alleged ATM jackpotting attacks in the United States total $40.73 million across over 1,500 attacks.

Since October 21, 2025, DOJ has indicted 98 individuals for their roles and involvement in ATM jackpotting schemes. As noted in a June 26, 2026 DOJ press release, the investigation has established extensive direct and indirect links between the indicted defendants and TdA. DOJ

Photographs released by DOJ depicting alleged ATM jackpotting schemes in progress and equipment used

has charged the defendants with a range of federal offenses that include material support to a designated foreign terrorist organization, bank burglary, money laundering, damage and unauthorized access to protected computers, bank fraud, and conspiracy to commit the same offenses. If convicted, the defendants face maximum penalties of between 20 and 335 years in prison.

CASH ME IF YOU CAN: TARGETING TdA ATM JACKPOTTING FACILITATORS

Indicted in the U.S. District Court for the District of Nebraska (USDC-NE) and included on the FBI’s Ten Most Wanted Fugitives list, Anibal Alexander Canelon Aguirre (aka “Prometheus”) is wanted for leading a large international conspiracy that deploys numerous crews to the United States to steal millions of dollars from financial institutions in support of TdA. Prometheus is the alleged engineer of the malware used in ATM jackpotting attacks and has been photographed posing with proceeds of the crime. Among other methods, Prometheus uses cryptocurrency transactions to launder proceeds of ATM jackpotting attacks.

Carlos Javier Martinez Armenta, Alejandro Mejia Castillo, Jose Dario Galeano Bazurto, Eric Gabriel Cardenas Arzola, Oscar Leonardo Martinez Pirona, and Anthony Wuiliam Hernandez Guerrero are associates of Prometheus who are also indicted in the USDC-NE for their involvement in the TdA ATM jackpotting scheme. These individuals are charged with providing material support to TdA, bank fraud conspiracy, bank burglary conspiracy, and/or money laundering conspiracy. Additionally, these individuals use cryptocurrency transactions to facilitate the laundering of ATM jackpotting proceeds.

Carlos Javier Martinez Armenta has transacted directly with Hector Rusthenford Guerrero Flores (a.k.a. Nino Guerrero), the now deceased head of TdA. In addition to his alleged participation in the TdA ATM jackpotting scheme, Oscar Leonardo Martinez Pirona has transacted with Venezuelan entertainer Jimena Romina Araya Navarro, who was previously designated by OFAC for having materially assisted, sponsored, or provided financial, material, or technological support for, or goods or services to or in support of TdA.

Aslhy Javier Galeano Basurto was also indicted in the USDC-NE for conspiracy to provide material support to TdA, among other charges, and has previously been detained in the United States on suspicion of manipulating ATMs. At the time of his arrest in 2017, he was found with drugs and backpacks full of a large amount of cash.

Oscar Leonardo Martinez Pirona owns a Mexico-based business, Enigma Community, S. de R.L. de C.V.

Additionally, Alejandro Mejia Castillo owns a Mexico-based business, Soluciones Integrales Toluca, S.A. de C.V.

OFAC designated Prometheus, Carlos Javier Martinez Armenta, Alejandro Mejia Castillo, Jose Dario Galeano Bazurto, Eric Gabriel Cardenas Arzola, Oscar Leonardo Martinez Pirona, Anthony Wuiliam Hernandez Guerrero, and Aslhy Javier Galeano Basurto pursuant to E.O. 13581, as amended, and E.O. 13224, as amended, for having materially assisted, sponsored, or provided financial, material, or technological support for, or goods or services to or in support of, TdA.

Additionally, OFAC designated Enigma Community, S. de R.L. de C.V. pursuant to E.O. 13581, as amended, for being owned or controlled by, or having acted or purported to act for or on behalf of, directly or indirectly, Oscar Leonardo Martinez Pirona. OFAC designated Enigma Community, S. de R.L. de C.V. pursuant to E.O. 13224, as amended, for being owned, controlled, or directed by, or having acted or purported to act for or on behalf of, directly or indirectly, Oscar Leonardo Martinez Pirona. OFAC designated Soluciones Integrales Toluca, S.A. de C.V. pursuant to E.O. 13581, as amended, for being owned or controlled by, or having acted or purported to act for or on behalf of, directly or indirectly, Alejandro Mejia Castillo. Additionally, OFAC designated Soluciones Integrales Toluca, S.A. de C.V. pursuant to E.O. 13224, as amended, for being owned, controlled, or directed by, or having acted or purported to act for or on behalf of, directly or indirectly, Alejandro Mejia Castillo.

GO FOR GOLD: TARGETING TdA GOLD MINING FACILITATOR

Indicted in the U.S. District Court for the Southern District of Texas in December 2025 for conspiring to provide and providing material support to TdA, Juan Gabriel Rivas Nunez (a.k.a. Juancho) is reportedly a high-ranking TdA leader who operates out of multiple South American countries and directs operations, including gold mining, narcotics exporting, and violent crime.

OFAC designated Juancho pursuant to E.O. 13581, as amended, and E.O. 13224, as amended, for having acted or purported to act for or on behalf of, directly or indirectly, TdA.

SANCTIONS IMPLICATIONS

As a result of today’s action, all property and interests in property of the designated or blocked persons described above that are in the United States or in the possession or control of U.S. persons are blocked and must be reported to OFAC. In addition, any entities that are owned, directly or indirectly, individually or in the aggregate, 50 percent or more by one or more blocked persons are also blocked. Unless authorized by a general or specific license issued by OFAC, or exempt, OFAC’s regulations generally prohibit all transactions by U.S. persons or within (or transiting) the United States that involve any property or interests in property of designated or otherwise blocked persons.

Violations of U.S. sanctions may result in the imposition of civil or criminal penalties on U.S. and foreign persons. OFAC may impose civil penalties for sanctions violations on a strict liability basis. OFAC’s Economic Sanctions Enforcement Guidelines provide more information regarding OFAC’s enforcement of U.S. economic sanctions. In addition, financial institutions and other persons may risk exposure to sanctions for engaging in certain transactions or activities involving designated or otherwise blocked persons. The prohibitions include the making of any contribution or provision of funds, goods, or services by, to, or for the benefit of any designated or blocked person, or the receipt of any contribution or provision of funds, goods, or services from any such person. Non-U.S. persons are also prohibited from causing or conspiring to cause

U.S. persons to wittingly or unwittingly violate U.S. sanctions, as well as engaging in conduct that evades U.S. sanctions. Individuals located in the United States or abroad who provide information about sanctions violations to the Financial Crimes Enforcement Network’s whistleblower incentive program may be eligible for awards if the information they provide leads to a successful enforcement action that results in monetary penalties exceeding $1,000,000.

Furthermore, engaging in certain transactions involving the persons designated today pursuant to E.O. 13224, as amended, may risk the imposition of secondary sanctions on participating foreign financial institutions. OFAC can prohibit or impose strict conditions on opening or maintaining, in the United States, a correspondent account or a payable-through account of a foreign financial institution that knowingly conducts or facilitates any significant transaction on behalf of a person who is designated pursuant to the relevant authority.

The power and integrity of OFAC sanctions derive not only from OFAC’s ability to designate and add persons to the Specially Designated Nationals and Blocked Persons List (SDN List), but also from its willingness to remove persons from the SDN List consistent with the law. The ultimate goal of sanctions is not to punish, but to bring about a positive change in behavior. For information concerning the process for seeking removal from an OFAC list, including the SDN List, or to submit a request, please refer to OFAC’s guidance on Filing a Petition for Removal from an OFAC List.

Click here for more information on the persons designated today.

###

Legal Disclaimer:

EIN Presswire provides this news content "as is" without warranty of any kind. We do not accept any responsibility or liability for the accuracy, content, images, videos, licenses, completeness, legality, or reliability of the information contained in this article. If you have any complaints or copyright issues related to this article, kindly contact the author above.