Investigation into International “ATM Jackpotting” Scheme and Tren de Aragua results in Additional Indictment and 87 Total Charged Defendants

A federal grand jury in the District of Nebraska returned an additional indictment charging 31 individuals for their roles in a large conspiracy to deploy malware and steal millions of dollars from ATMs in the United States, a crime commonly referred to as “ATM jackpotting.” Fifty-six others have already been charged. Many of the defendants charged in this Homeland Security Task Force operation are Venezuelan and Colombian nationals including illegal alien Tren de Aragua (TdA) members. This indictment alleges 32 counts including conspiracy to commit bank fraud, conspiracy to commit bank burglary and computer fraud, bank fraud, bank burglary, and damage to computers.

“Tren de Aragua is a complex terrorist organization that commits serious financial crimes in addition to horrific rapes, murders, and drug trafficking,” said Attorney General Pamela Bondi. “This Department of Justice has already prosecuted more than 290 members of Tren de Aragua and will continue working tirelessly to put these vicious terrorists behind bars after the prior administration let them infiltrate our country.”

“A large ring of criminal aliens allegedly engaged in a nationwide conspiracy to enrich themselves and the TdA terrorist organization by ripping off American citizens," said Deputy Attorney General Todd Blanche. "After committing bank robbery, fraud, and other serious crimes, they will be vigorously prosecuted and held accountable for their crimes. The Justice Department’s Joint Task Force Vulcan will not stop until it completely dismantles and destroys TdA and other foreign terrorists that import chaos to America.”

“This latest indictment demonstrates the Criminal Division’s commitment to dismantling cartels, including when they attack our nation’s financial systems with sophisticated malware,” said Assistant Attorney General A. Tysen Duva of the Justice Department’s Criminal Division. “The announcement of charges against a total of 87 defendants underscores both the massive scale of these alleged conspiracies and the strength and skill of our investigators and prosecutors who dismantle them. As cartels level up their criminal game, so will we.”

“Tren de Aragua uses ATM jackpotting crimes committed all across America to fund its terrorist organization which is responsible for horrific crimes such as human trafficking (to include sex trafficking of children in Nebraska), kidnapping, murder and other unspeakably evil and violent acts,” said U.S. Attorney Lesley A. Woods for the District of Nebraska. “The U.S. Attorney’s Office for the District of Nebraska will fight TdA directly by taking every action at our disposal to shut down their financial pipeline and handicap their ability to terrorize American communities.”

“TdA grew from a prison gang to a transnational criminal organization to a foreign terrorist organization. Using sophisticated malware to empty ATMs and damage U.S. financial institutions that also fund TdA’s terrorist activity will not be tolerated,” said Joint Task Force Vulcan (JTFV) Co-Director Chris Eason. “The charges against certain TdA members are directly in line with JTFV’s mission: a collaborative, whole of government effort to destroy TdA. We are grateful for our partnership with the U.S. Attorney’s Office for the District of Nebraska, and our law enforcement partners who worked tirelessly to investigate and bring these important charges.”

“A dedicated team of FBI Omaha agents and analysts are working shoulder to shoulder with our local, state, and federal partners to disrupt and dismantle an international criminal conspiracy ultimately funding a foreign terrorist organization,” said Special Agent in Charge Eugene Kowel of the FBI Omaha Field Office. “The wide variety of sophisticated criminal tactics employed by TdA poses a direct threat to communities across our country. This case highlights TdA's plot to deploy malware to steal vast funds from financial institutions across the United States. We will never stop following the money and surging resources to arrest and apprehend TdA members and leadership.”

The following photographs depict just a few of the alleged ATM jackpotting scheme in progress and equipment used:

The alleged conspiracy developed and deployed a variant of malware known as Ploutus, which was used to hack into ATMs and force ATMs to dispense cash. The conspiracy relied on the recruitment of a number of individuals to deploy Ploutus malware nationwide. Members of the conspiracy and TdA would travel in groups, using multiple vehicles, to the locations of targeted banks and credit unions. These groups would conduct initial reconnaissance and take note of external security features at the ATMs. Following this reconnaissance, the groups would open the hood or door of ATMs and then wait nearby to see whether they had triggered an alarm or a law enforcement response. The groups would then take steps to install malware on the ATMs, by removing the hard drive and installing the malware directly, by replacing the hard drive with one that had been pre-loaded with the Ploutus malware, or by connecting an external device such as a thumb drive that would deploy the malware. The Ploutus malware’s primary purpose was to issue unauthorized commands associated with the Cash Dispensing Module of the ATM in order to force withdrawals of currency. The Ploutus malware was also designed to delete evidence of malware in an effort to conceal, create a false impression, mislead, or otherwise deceive employees of the banks and credit unions from learning about the deployment of the malware on the ATM. Members of the conspiracy would then split the proceeds in predetermined portions.

The most recent indictment follows a previous one returned on Dec. 9, 2025, that alleged that TdA, a designated Foreign Terrorist Organization, conducted jackpotting attacks across America. The Dec. 9, 2025 indictment charged 22 individuals with offenses for their roles in the conspiracy: 13 individuals are charged with conspiracy to provide material support to terrorists, 10 with conspiracy to commit bank fraud, 10 with conspiracy to commit bank burglary and fraud and related activity in connection with computers, and 22 with conspiracy to commit money laundering. The indictment also alleges that TdA used jackpotting to steal millions of dollars in the United States and then transferred the proceeds among its members and associates to conceal the illegally obtained cash. The indictment alleged a national conspiracy to commit these offenses with crimes committed all over the United States in furtherance of these conspiracies that generated millions in illegal proceeds for the combined defendants and the TdA organization.

A related indictment returned on Oct. 21, 2025 charged 32 individuals and alleged 56 counts including one count of conspiracy to commit bank fraud, one count of conspiracy to commit bank burglary and computer fraud, 18 counts of bank fraud, 18 counts of bank burglary, and 18 counts of damage to computers.

If convicted, the defendants face maximum terms of imprisonment ranging between 20 and 335 years.

According to court documents, TdA is a violent transnational criminal organization that originated as a prison gang in Venezuela in the mid-2000s. TdA has expanded its criminal network throughout the Western Hemisphere and established a presence in the United States. TdA’s criminal activities range from drug trafficking and firearms trafficking, to commercial sex trafficking, kidnapping, robbery, theft, fraud, and extortion. TdA members also commit murder, assault, and other violent acts to advance the organization’s criminal activities. TdA has also developed an additional source of revenue stream through financial crimes that target financial institutions throughout the United States, including using jackpotting to steal millions of dollars in cash.

In the past six months, the Justice Department has charged a total of 87 TdA members and leaders with a range of federal offenses that include material support to a designated foreign terror organization, bank burglary, money laundering, damage and unauthorized access to protected computers, bank fraud, and conspiracy to commit the same offenses.

FBI’s Omaha Field Office and U.S. Immigration and Customs Enforcement Homeland Security Investigations (HSI) Omaha is investigating the case, with assistance from FBI’s Denver, Houston, Miami, Oklahoma, Sacramento, Seattle, and Springfield Field Offices, and the U.S. Secret Service, United States Marshals Service, Customs and Border Protection, U.S. Border Patrol, United States Citizenship and Immigration Services, Federal Housing Finance Agency Office of the Inspector General, Financial Deposit Insurance Corporation, Adams County Sheriff’s Office, Appanoose County Sheriff’s Office, Bates County Sheriff’s Office, Sheridan Police Department, Lake County Sheriff’s Office, Leesburg Police Department, Sterling Heights Police Department, Kearney Police Department, Warrant Police Department, Douglas County Sheriff’s Office, Colombus Police Department, Cass County Sheriff’s Office, Nebraska State Patrol Crime Laboratory, Bluff City Police Department, Tennessee Bureau of Investigation, Lincoln Police Department, Gothenburg Police Department, Loudon Police Department, Alcoa Police Department, Kearney Police Department, Milford Police Department, Grand Island Police Department, Nebraska State Patrol, Papillion Police Department, Central City Police Department, Holdrege Police Department, New York State Police, Berkeley Police Department, Cook County Electronic Monitoring Unit, Aurora Police Department, Austin Police Department, U.S. Capitol Police, Buffalo County Sheriff’s Office, City of Rome Police Department, Lancaster County Sheriff’s Office, McCook Police Department, Nebraska DMV Crime Analysts, Rantoul Police Department, Olathe Police Department, North Platte Police Department, Walla Walla Police Department, Milton-Freewater Police Department, Missoula Police Department, Omaha Police Department, Larimer County Sheriff’s Office, Sidney Police Department, Denver Police, Howard County Sheriff’s Office, St. Paul Police Department, Ozaukee County Sheriff’s Office, Glendale Police Department, Columbia Police Department, Brookfield Police Department, Wauwatosa Police Department, Mount Pleasant Police Department, Grafton Police Department, South Milwaukee Police Department, Dubuque Police Department, Fargo Police Department, and Paducah Police Department.

This case is being prosecuted by the Justice Department’s Computer Crime and Intellectual Property Section, the U.S. Attorney’s Office for the District of Nebraska, and Joint Task Force Vulcan. The U.S. Attorney’s Offices for the Western District of Washington, Eastern District of California, Southern District of New York, Northern District of Illinois, Central District of Illinois, Eastern District of Oklahoma, District of New Mexico, Southern District of Florida, Eastern District of Wisconsin, and the District of Colorado, as well as the Larimer County Attorney’s Office, Colorado Attorney General’s Office, Tennessee 9th District Attorney General’s Office, Tennessee 5th District Attorney General’s Office and the Office of the Oklahoma Attorney General provided significant assistance.

This Operation is part of the Homeland Security Task Force (HSTF) initiative established by Executive Order 14159, Protecting the American People Against Invasion. The HSTF is a whole-of-government partnership dedicated to eliminating criminal cartels, foreign gangs, transnational criminal organizations, and human smuggling and trafficking rings operating in the United States and abroad. Through historic interagency collaboration, the HSTF directs the full might of United States law enforcement towards identifying, investigating, and prosecuting the full spectrum of crimes committed by these organizations, which have long fueled violence and instability within our borders. In performing this work, the HSTF places special emphasis on investigating and prosecuting those engaged in child trafficking or other crimes involving children. The HSTF further utilizes all available tools to prosecute and remove the most violent criminal aliens from the United States. HSTF Omaha comprises agents and officers from the FBI and HSI.

Joint Task Force Vulcan (JTFV) was created in 2019 to eradicate MS-13 and now expanded to target TdA is comprised of U.S. Attorney’s Offices across the country. Those include Southern and Eastern Districts of New York; Eastern and Western Districts of North Carolina; Eastern and Western Districts of Virginia; Southern District of Florida; Eastern District of Texas; Western District of Oklahoma; Northern District of Indiana; and the District of Nevada, as well as the Executive Office for U.S. Attorneys, Department of Justice’s National Security Division and the Criminal Division. Additionally, the FBI, DEA, HSI, ATF, USMS, and the Bureau of Prisons are essential law enforcement partners with JTFV.

An indictment or a complaint is merely an allegation. All defendants are presumed innocent until proven guilty beyond a reasonable doubt in a court of law.