Loading story…
The US Department of Justice has indicted 54 alleged members of the Venezuelan Tren de Aragua gang for orchestrating a widespread ATM jackpotting campaign across the United States using a variant of the Ploutus malware. The group is accused of physically tampering with ATMs at banks and credit unions, either by installing malware-laden hard drives or deploying the malware via external devices, enabling them to force machines to dispense large sums of cash. The attacks, which reportedly began in early 2024, targeted dozens of ATMs, with some financial institutions suffering losses exceeding $100,000 and at least one credit union in Nebraska losing approximately $300,000.
Authorities allege that the gang conducted reconnaissance to identify vulnerable ATMs, circumvented security features, and coordinated attacks in groups. The Justice Department estimates that at least $5.4 million was stolen by the indicted individuals, with an additional $1.4 million in attempted but unsuccessful thefts. The Ploutus malware, first observed in Mexico in 2013, specifically targets the cash-dispensing modules of ATMs, and its deployment in the US marks a significant escalation in organized cyber-enabled financial crime. US officials have labeled Tren de Aragua a "ruthless terrorist organization" and emphasized ongoing efforts to dismantle their operations and protect American financial infrastructure.
See the actors and campaigns active against you right now.
3 events from the most recent confirmed update back to the earliest known activity.
The U.S. Department of Justice announced charges against 54 individuals accused of participating in a nationwide ATM jackpotting operation tied to Tren de Aragua. The defendants allegedly used physical access and Ploutus malware to compromise ATMs, steal cash, and launder proceeds, with some also charged with providing material support to a terrorist organization.
According to the charging documents and reporting, members of Tren de Aragua began carrying out ATM jackpotting attacks in the United States by physically tampering with machines and installing Ploutus malware. The campaign allegedly stole at least $5.4 million, with additional failed attempts totaling about $1.4 million.
Ploutus, a malware family used to force ATMs to dispense cash, was first identified in Mexico. It later evolved to target multiple ATM platforms and operating systems and to erase evidence of attacks.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See the adversaries and campaigns active against your sector right now, ranked by what they're exploiting.
4 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourcesecurityaffairs.com
Open sourcego.theregister.com
Open sourcetherecord.media
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
US prosecutors unsealed a federal grand jury indictment charging **31 additional defendants** for allegedly participating in an **ATM “jackpotting”** conspiracy that used **Ploutus** malware to force ATMs to dispense cash until empty. Court filings and DOJ statements describe a hands-on tradecraft: crews surveilled target ATMs, opened housings to test alarm response, then either swapped hard drives with preloaded ones or used USB devices to deploy the malware; the tooling also supported evidence deletion to hinder investigations. Authorities allege the operation stole at least **$5.4 million from 63 ATMs** (many at credit unions) over a period spanning **Feb 2024–Dec 2025**, with proceeds split and moved among participants to facilitate laundering. The DOJ and reporting link parts of the conspiracy to **Tren de Aragua (TdA)**, a Venezuelan transnational criminal organization that the US Treasury’s **OFAC** designated as a **Foreign Terrorist Organization** (per the cited coverage), and the latest indictment follows earlier rounds of charges against dozens of suspects for related conduct (including bank fraud, bank burglary, computer fraud, and damage to computers). Separate reporting in this set covers unrelated law-enforcement actions involving an alleged **hitman-for-hire** website in Romania and arrests in the Netherlands tied to a **$1.6M NFT theft**; those cases do not appear connected to the Ploutus ATM malware conspiracy.
Jun 29, 2026
Five Venezuelan nationals pleaded guilty to conspiracy to commit bank larceny after attempting to install malware and jackpot ATMs in Wamego and Manhattan, Kansas. The December 2025 operation failed twice and triggered police alarms; Luis Alberto Velasquez-Artigas received a nine-month prison sentence, while the remaining defendants await sentencing. A related Nebraska case resulted in an eight-year sentence for Juan Manuel Gouveia-Aguilera over conduct tied to more than $3.5 million in ATM losses. Federal investigators link numerous U.S. ATM-jackpotting incidents to the **Ploutus** malware family, which has been active since its discovery in Mexico in 2013. A Ploutus-D variant observed in Latin America targeted Diebold ATMs through KAL's Kalignite multivendor platform, disabled security-monitoring processes, and enabled cash-outs using a physically connected keyboard and time-limited activation code. Authorities report more than 1,900 ATM-jackpotting incidents since 2020 and over $58 million in losses since 2021; prosecutors allege some schemes financed Venezuelan transnational criminal organizations, though available evidence does not conclusively tie Ploutus development to Tren de Aragua.
Sep 4, 2026
The U.S. Treasury Department sanctioned eight alleged Tren de Aragua (TdA) members, two Mexico-based companies, and seven **TRON** cryptocurrency addresses over an ATM-jackpotting operation that allegedly stole more than **$40 million** from U.S. banks. Treasury said the Mexico- and Venezuela-based network used custom malware to force ATMs and interactive teller machines to dispense cash without debiting accounts, causing reported losses of $40.73 million in more than 1,500 attacks through August 2025. Among those designated is alleged malware developer and FBI Top Ten fugitive Anibal Alexander Canelon Aguirre, known as “Prometheus,” as well as alleged senior TdA leader Juan Gabriel Rivas Nunez. Authorities said the group laundered cash-out proceeds through complex cryptocurrency channels to TdA leadership. The seven sanctioned exchange-hosted TRON deposit addresses received approximately $6.1 million from March 2022 and transferred funds onward to TdA-linked wallets. The designations, issued under Executive Orders 13581 and 13224, block U.S.-linked property interests and create secondary-sanctions exposure for foreign financial institutions that knowingly facilitate significant transactions for the listed parties. The Justice Department has indicted 98 people in the alleged nationwide conspiracy since October 2025 on charges including bank fraud, bank burglary, money laundering, and material support.
Sep 30, 2026