Federal prosecutors in Nebraska have charged 54 alleged members and leaders of Tren de Aragua in a sweeping cybercrime case, accusing the Venezuelan-based organization of hacking ATMs across the United States to steal millions of dollars used to fund criminal and terror-related activities.
According to the U.S. Attorney’s Office for the District of Nebraska, two federal indictments allege that Tren de Aragua (TdA) deployed malware to compromise ATMs nationwide in a scheme known as “ATM jackpotting,” allowing members to force machines to dispense large sums of cash.
Prosecutors say the stolen money was then laundered and transferred among TdA members and associates to conceal its origin.
An indictment returned on December 9 charges 22 defendants with offenses including conspiracy to provide material support to terrorists, conspiracy to commit bank fraud, conspiracy to commit bank burglary, computer fraud, and money laundering. A related indictment returned in October charges 32 additional defendants with dozens of counts tied to bank fraud, computer damage, and burglary.
If convicted, defendants face potential sentences ranging from 20 years to more than three centuries in prison, depending on the charges.
Alleged Leadership Ties and International Network
Prosecutors allege that the jackpotting operation functioned as a revenue stream for Tren de Aragua’s leadership and was coordinated across state lines using recruited teams that traveled to targeted banks and credit unions.
One of the defendants named is Jimena Romina Araya Navarro, an alleged leader of Tren de Aragua who was previously sanctioned by the U.S. Department of the Treasury’s Office of Foreign Assets Control. According to prosecutors and Treasury officials, Araya Navarro is alleged to have helped TdA leaders launder money and maintain operational ties to senior figures within the organization.
Federal authorities allege that Araya Navarro assisted TdA leader Héctor Rusthenford Guerrero Flores — also known as “Niño Guerrero” — in escaping from Tocorón Prison in Venezuela and later supported the organization’s financial operations.
ATM Malware and Nationwide Attacks
According to court documents, the conspiracy relied on a malware variant known as Ploutus, which allowed attackers to override ATM controls and force machines to dispense cash.
Prosecutors allege TdA teams conducted reconnaissance at targeted locations, bypassed security features, installed malware directly onto ATM hard drives or through external devices, and then divided the stolen proceeds according to predetermined shares. The malware was allegedly designed to erase evidence of intrusion to delay detection by financial institutions.
The alleged jackpotting incidents occurred across multiple states, with millions of dollars stolen from U.S. banks and credit unions.
Related Leadership Case Unsealed in New York
The Nebraska indictments follow a separate federal case unsealed this week in Manhattan, as previously reported by The Dallas Express, charging Guerrero Flores, the alleged leader of Tren de Aragua, with racketeering, terrorism-related offenses, cocaine trafficking, and weapons crimes. In that case, federal prosecutors allege Guerrero Flores oversaw Tren de Aragua’s expansion from a Venezuelan prison-based gang into a transnational criminal organization operating across the Western Hemisphere.
Guerrero Flores remains at large, and the U.S. State Department is offering a reward of up to $5 million for information leading to his arrest or conviction.
Prior Warnings From Venezuelan Intelligence Insider
The cybercrime allegations also follow earlier warnings raised by former Venezuelan intelligence chief Hugo Carvajal Barrios, who alleged in a letter obtained exclusively by The Dallas Express that the Maduro regime exported criminal networks — including Tren de Aragua — into the United States while working in concert with state-linked trafficking organizations.
Carvajal, who previously pleaded guilty in U.S. federal court to a narco-terrorism conspiracy, claimed Venezuelan officials used a range of criminal enterprises to generate revenue and project influence abroad. The Dallas Express reported at the time that Carvajal’s allegations had not been independently verified and were presented as claims from a cooperating former regime insider.
Multi-Agency Operation
The Nebraska case was investigated by the FBI, Homeland Security Investigations, and multiple state and local law enforcement agencies as part of Joint Task Force Vulcan and the Homeland Security Task Force initiative. Federal officials said the case demonstrates a coordinated effort to dismantle Tren de Aragua’s operational and financial networks inside the United States.
Prosecutors emphasized that the charges are allegations and that all defendants are presumed innocent unless and until proven guilty.
