OCCRP: The US Blacklists Alleged Venezuelan Cyber Crime Mastermind

• Canelón Aguirre and eight others were added to the specially designated nationals list, effectively locking them out of the global financial system.
• The jackpotting scheme looted millions of dollars from ATMs across several U.S. states starting at least in January 2024.

The U.S. Department of the Treasury blacklisted Aníbal Alexander Canelón Aguirre, a Venezuelan accused of leading a multi-million dollar ATM jackpotting operation for the Tren de Aragua gang, and added him and eight others to the specially designated nationals list. This action blocks their access to the global financial system and targets a network accused of laundering proceeds through a transnational criminal organization.

Canelón Aguirre, wanted by the Justice Department and previously on the FBI’s Ten Most Wanted list, is accused of creating malware used to loot ATMs in the U.S. and laundering the proceeds through Tren de Aragua. The broader case now includes 87 defendants nationwide, with charges ranging from bank fraud to providing material support to a foreign terrorist organization.

• 87 defendants in the jackpotting case

• Screen all transactions and customer relationships for Aníbal Alexander Canelón Aguirre and the eight other newly blacklisted individuals on the specially designated nationals list.
• Review exposure to Tren de Aragua and related entities, including any links to ATM jackpotting typologies described in the indictment of Canelón Aguirre.
• Update monitoring rules for transactions involving Venezuela, Mexico, and known aliases such as 'El Ingeniero', 'Prometeo', and 'Prometheus' to detect possible money laundering linked to this network.

This case highlights the convergence of cybercrime and transnational organized crime, with a sophisticated network using malware to loot millions from U.S. ATMs and launder proceeds through a group designated as a foreign terrorist organization. The addition of Canelón Aguirre and associates to the specially designated nationals list requires immediate compliance action to block assets and prevent financial system abuse. It also underscores the need for vigilance against evolving cyber-enabled money laundering typologies and the importance of screening for individuals and entities linked to high-profile criminal networks.