OFAC Sanctions Tren de Aragua for ATM Jackpotting; Threat Actors Use Blockchains for Malware

OFAC Sanctions Tren de Aragua for ATM Jackpotting

The U.S. Treasury's Office of Foreign Assets Control (OFAC) sanctioned 10 targets linked to a Tren de Aragua ATM jackpotting scheme. This operation stole at least $40.73 million from U.S. financial institutions. Tren de Aragua is designated as a Foreign Terrorist Organization.

The group used Ploutus malware for jackpotting attacks, forcing ATMs to dispense cash. Reported losses from over 1,500 alleged attacks reached $40.73 million as of August 2025. The network laundered proceeds using cryptocurrency, with seven designated crypto wallet addresses receiving approximately $6.1 million in inflows since March 2022.

Blockchain Used for Malware Concealment

Cyber threat actors are employing public blockchains to hide malware instructions, a method known as EtherHiding or Blockchain Dead Drops (BDD). This technique complicates efforts to seize or take down the malicious code.

Chainalysis reported that North Korean and Iranian-state operators are developing distinct blockchain dead drop techniques. BDDs have increased by 440% since the introduction of Chinese high-capacity open-source AI models.

Implications for Financial Crime and Cybersecurity

The OFAC sanctions demonstrate a focus on disrupting both the perpetrators and financial facilitators of terrorist financing, particularly when cryptocurrency is involved. The use of blockchains for malware concealment presents a new challenge for cybersecurity, as the decentralized nature of these platforms makes traditional takedown methods less effective.