U.S. Treasury Sanctions Ten Venezuelan Actors Tied to ATM Malware Ring Linked to Tren de Aragua

The U.S. Treasury’s Office of Foreign Assets Control (OFAC) announced sanctions against ten Venezuelan nationals and several companies they control, accusing them of operating a sophisticated scheme that infected dozens of automated teller machines with malware to steal cash.

According to the sanction notice, the individuals and entities are part of the broader criminal network known as Tren de Aragua, a loosely organized group that has been linked to a range of illicit activities, including drug trafficking, extortion and money‑laundering operations. The ATM scheme allegedly allowed the group to siphon funds directly from machines in multiple countries before routing the proceeds through a web of front companies to obscure their origin.

OFAC’s action designates the listed parties as Specially Designated Nationals (SDNs), effectively cutting them off from the U.S. financial system. Any assets they hold under U.S. jurisdiction are frozen, and U.S. persons are prohibited from conducting transactions with them. The move also signals a broader effort by Washington to target the financial infrastructure that enables transnational crime.

Authorities say the malware was deployed by compromising the software that runs ATM networks, allowing the perpetrators to dispense cash without triggering alarms. While the exact amount stolen has not been disclosed, the operation is described as having affected “dozens” of machines, suggesting a multi‑million‑dollar haul that would have been laundered through the sanctioned companies.

The sanctions follow a pattern of increased pressure on Venezuelan criminal groups that have exploited the country’s economic turmoil to expand overseas. In recent years, the U.S. has targeted drug shipments, cyber‑crime operations and illicit gold trade linked to Venezuela, aiming to disrupt revenue streams that could fund both organized crime and the Maduro regime.

Legal analysts note that the designation could have ripple effects for banks and payment processors that unwittingly handled transactions linked to the sanctioned entities. Compliance teams will need to review past dealings to ensure they are not in violation of the new restrictions, and may be required to report any questionable activity to the Treasury.

While the sanctions represent a concrete step, officials warn that dismantling the entire ATM‑malware operation will require continued international cooperation. OFAC has indicated that further actions may be taken against additional actors if evidence emerges of ongoing or related illicit activity.