A federal jury has charged 31 suspects in a conspiracy to use malware and steal millions of dollars across the nation – a tactic known as “ATM jackpotting.” The scheme was tied to the brutal Venezuelan cartel Tren de Aragua.
“A large ring of criminal aliens allegedly engaged in a nationwide conspiracy to enrich themselves and the TdA terrorist organization by ripping off American citizens,” said Deputy Attorney General Todd Blanche in a press release. “After committing bank robbery, fraud, and other serious crimes, they will be vigorously prosecuted and held accountable for their crimes.”
The suspects are facing 32 counts of bank fraud, conspiracy to commit bank fraud, bank burglary, conspiracy to commit bank burglary, computer fraud, and damage to computers, the Department of Justice announced January 26.
A federal jury in the District of Nebraska returned the indictment. If convicted, the suspects could face maximums ranging from 20 to 335 years in prison.
Officials have already charged 56 other suspects for their roles in the scheme. Many are Venezuelan and Colombian nationals, including illegal aliens who are allegedly members of Tren de Aragua.
“Charges against a total of 87 defendants underscores both the massive scale of these alleged conspiracies and the strength and skill of our investigators and prosecutors who dismantle them,” DOJ Criminal Division Assistant Attorney General A. Tysen Duva in the release. “As cartels level up their criminal game, so will we.”
The Scheme
The suspects allegedly developed and used malware known as “Ploutus” to hack into ATMs and force them to dispense cash, according to the release. The conspiracy relied on a network of suspects to deploy the software across America.
They, along with members of Tren de Aragua, would reportedly travel in groups with multiple vehicles to banks and credit unions. There, they would perform initial recon and note security features of ATMs.
“Following this reconnaissance, the groups would open the hood or door of ATMs and then wait nearby to see whether they had triggered an alarm or a law enforcement response,” the release reads.
They would allegedly install the malware – either by removing the hard drive and installing the Ploutus malware directly, by replacing the hard drive with one already infected, or by connecting an external device, such as a thumb drive, to upload the malware.
The malware would make the ATMs dispense cash and erase all evidence that it had ever been there. The suspects then allegedly split the proceeds, as they had previously agreed.
“The wide variety of sophisticated criminal tactics employed by TdA poses a direct threat to communities across our country,” said FBI-Omaha Special Agent in Charge Eugene Kowel in the release. “This case highlights TdA’s plot to deploy malware to steal vast funds from financial institutions across the United States. We will never stop following the money and surging resources to arrest and apprehend TdA members and leadership.”
A Deeper Issue
A jury had also charged 22 suspects in the conspiracy on December 9, 2025. Among these defendants, 13 were charged with conspiracy to support terrorists, 10 were charged with conspiracy to commit bank fraud, 10 were charged with conspiracy to commit bank burglary and computer fraud, and all 22 were charged with conspiracy to commit money laundering.
Earlier, on October 21, another indictment charged 32 suspects with their roles. It listed 56 charges, including 18 counts of bank fraud, 1 count of conspiracy to commit bank fraud, 18 counts of bank burglary, 1 count of conspiracy to commit bank burglary and computer fraud, and 18 counts of computer damage.
“Tren de Aragua uses ATM jackpotting crimes committed all across America to fund its terrorist organization which is responsible for horrific crimes such as human trafficking (to include sex trafficking of children in Nebraska), kidnapping, murder and other unspeakably evil and violent acts,” said U.S. Attorney for the District of Nebraska Lesley Woods in the release.
Tren de Aragua began as a Venezuelan prison gang in the mid-2000s, according to the release. As The Dallas Express reported, it has since expanded across the West – building a presence in the United States, with the State Department offering a $5 million reward for its leader.
The cartel gained national attention in June 2024, when leaders of Aurora, Colorado, called for help cracking down on Tren de Aragua members who had taken over apartment complexes, as The New York Post reported at the time.
That September, Texas Gov. Greg Abbott labeled Tren de Aragua a foreign terrorist organization – around the same time reports exposed the cartel had gained a foothold in a North Dallas apartment complex. Abbott’s terror designation helped lay the groundwork for President Donald Trump’s later executive order.
“Tren de Aragua is a complex terrorist organization that commits serious financial crimes in addition to horrific rapes, murders, and drug trafficking,” said Attorney General Pamela Bondi in the release. “This Department of Justice has already prosecuted more than 290 members of Tren de Aragua and will continue working tirelessly to put these vicious terrorists behind bars after the prior administration let them infiltrate our country.”
This case was part of Joint Task Force Vulcan, formed in 2019 to target MS-13 – now expanded to target TdA. The group comprises U.S. Attorney’s Offices nationwide.
FBI-Omaha and ICE HSI-Omaha are investigating the case. FBI offices in Denver, Houston, Miami, Oklahoma, Sacramento, Seattle, and Springfield are helping, along with the Border Patrol, Customs and Border Protection, FDIC, Federal Housing Finance Agency Office of Inspector General, and FDIC. Local agencies are also helping, including the Austin Police Department.
The DOJ Computer Crime and Intellectual Property Section, the U.S. Attorney for the District of Nebraska, and Joint Task Force Vulcan are prosecuting this case.
“TdA grew from a prison gang to a transnational criminal organization to a foreign terrorist organization,” said JTFV Co-Director Chris Eason in the release. “Using sophisticated malware to empty ATMs and damage U.S. financial institutions that also fund TdA’s terrorist activity will not be tolerated.”
