Tren De Aragua
Tren de Aragua (TdA; Spanish for "the train of Aragua") is a Venezuelan transnational criminal organization, described in the provided content as originating as a Venezuelan prison gang and later expanding internationally. The content states that the U.S. government designated TdA as a Foreign Terrorist Organization in 2025, while also noting that internal U.S. government records and a National Intelligence Council assessment reflected significant uncertainty about whether TdA operated in the United States as a coherent, centrally directed organization or was directly controlled by the Maduro government. Based on the content, TdA-linked activity in the United States has included a large-scale ATM jackpotting campaign using Ploutus malware. U.S. prosecutors alleged that TdA members and leaders physically accessed ATMs, conducted surveillance and alarm-response testing, installed Ploutus via hard-drive swaps or USB devices, forced ATMs to dispense cash, deleted evidence, laundered proceeds, and generated millions of dollars in illicit revenue. The content states that U.S. authorities charged 54, and later 87, alleged TdA members and associates in related indictments. The FBI also alleged that fugitive Anibal Alexander Canelon Aguirre led cyberattacks against U.S. financial institutions on behalf of TdA and was the alleged mastermind behind malware used by the group. The content further attributes to TdA a broader criminal portfolio including murder, assault, drug trafficking, firearms trafficking, kidnapping, robbery, theft, fraud, extortion, human smuggling, sexual exploitation, and money laundering across the Western Hemisphere. Internal U.S. records cited in the content characterize TdA-linked activity in the U.S. as fragmented and profit-driven, including burglaries, ATM jackpotting, delivery-app fraud, and low-level narcotics sales, with no clear evidence of centralized command or political motive. Known aliases in the content include TdA and Tren De Aragua.
Know when an actor pivots toward your sector
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Targeting
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Where they're from
Attributed origin per open-source reporting.
- VE
Associated malware families
1 malware family attributed to this actor across reporting.
Recent activity
20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Referenced as a Venezuelan street gang allegedly controlling the targeted apartment building and supposedly storing weapons there, though the article states this intelligence was never released or substantiated.
Referenced comparatively as a criminal organization with decentralized structure relevant to analysis of organization and attribution in violent non-state groups.
Linked to a large-scale ATM “jackpotting” operation in the United States, using Ploutus malware to force ATMs to dispense cash without bank authorization; members reportedly gained physical access to ATMs, staged malware on hard drives, and executed rapid cash-out events.
Linked by U.S. DOJ indictments to a conspiracy conducting ATM jackpotting (“cash-out”) operations using ATM malware to steal and launder millions of dollars.
The version that knows your environment.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.