U.S. Treasury Targets Venezuelan Network Behind ATM Malware Scheme

The U.S. Treasury Department’s Office of Foreign Assets Control (OFAC) announced sanctions against ten individuals and entities linked to a sophisticated ATM malware operation tied to the Venezuelan criminal group Tren de Aragua. The designation aims to disrupt a money‑laundering network that siphoned cash from dozens of compromised automated teller machines and funneled the proceeds through a web of front companies.

According to the sanctions filing, the targeted Venezuelan nationals and the companies they control were integral to the scheme’s financial infrastructure. By providing shell corporations and bank accounts, they enabled the illicit funds to be moved out of the United States and laundered across multiple jurisdictions, obscuring the origin of the stolen cash.

Authorities have been monitoring the use of malicious software that infects ATMs to dispense unauthorized cash, a tactic that has become increasingly common among transnational criminal outfits. The malware can be installed remotely or via physical access, allowing thieves to withdraw large sums without triggering immediate alarms. In this case, investigators traced the proceeds back to a network with ties to Tren de Aragua, a group already known for drug trafficking, extortion and other illicit activities.

Sanctioning the individuals and entities involved sends a clear signal that the United States will pursue financial enforcers of cyber‑enabled theft, even when the actors operate abroad. Under OFAC rules, any assets these parties hold within U.S. jurisdiction are frozen, and U.S. persons are prohibited from conducting transactions with them. The move also pressures foreign banks and businesses to conduct heightened due diligence when dealing with parties that might be linked to the scheme.

The action follows a broader U.S. effort to combat cybercrime and money‑laundering networks that exploit the global financial system. While the immediate impact on the Tren de Aragua operation remains to be seen, officials indicated that the sanctions are part of a continuing strategy to dismantle the financial channels that sustain organized crime. Observers expect further coordination with international partners to trace and seize assets tied to the ATM fraud enterprise.