Loading story…
US prosecutors unsealed a federal grand jury indictment charging 31 additional defendants for allegedly participating in an ATM “jackpotting” conspiracy that used Ploutus malware to force ATMs to dispense cash until empty. Court filings and DOJ statements describe a hands-on tradecraft: crews surveilled target ATMs, opened housings to test alarm response, then either swapped hard drives with preloaded ones or used USB devices to deploy the malware; the tooling also supported evidence deletion to hinder investigations. Authorities allege the operation stole at least $5.4 million from 63 ATMs (many at credit unions) over a period spanning Feb 2024–Dec 2025, with proceeds split and moved among participants to facilitate laundering.
The DOJ and reporting link parts of the conspiracy to Tren de Aragua (TdA), a Venezuelan transnational criminal organization that the US Treasury’s OFAC designated as a Foreign Terrorist Organization (per the cited coverage), and the latest indictment follows earlier rounds of charges against dozens of suspects for related conduct (including bank fraud, bank burglary, computer fraud, and damage to computers). Separate reporting in this set covers unrelated law-enforcement actions involving an alleged hitman-for-hire website in Romania and arrests in the Netherlands tied to a $1.6M NFT theft; those cases do not appear connected to the Ploutus ATM malware conspiracy.
See the reporting duties and controls this puts on the clock.
8 events from the most recent confirmed update back to the earliest known activity.
South Carolina prosecutors announced that two Venezuelan nationals convicted in a similar ATM jackpotting scheme will be deported after serving their sentences.
The U.S. Department of Justice announced a new federal grand jury indictment charging 31 additional people in the ATM jackpotting conspiracy, bringing total charges in the operation to 87 people over roughly six months.
DOJ alleges the conspiracy stole at least $5.4 million from at least 63 ATMs, mostly owned by credit unions, during attacks conducted from February 2024 through December 2025.
Federal prosecutors brought another round of charges against 22 additional individuals linked to the ATM malware operation.
The U.S. Treasury's OFAC designated Tren de Aragua as a Foreign Terrorist Organization, a move later cited by DOJ in describing the ATM thefts as supporting TdA activity.
An earlier federal indictment was returned against 32 defendants tied to the Ploutus-based ATM jackpotting conspiracy.
According to DOJ allegations, the conspiracy began attacking U.S. ATMs in February 2024, using surveillance and alarm-response testing before deploying Ploutus malware.
Symantec first detected the Ploutus ATM malware, which would later be used in jackpotting attacks that spread beyond Mexico to multiple ATM vendors.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See what this changes for your reporting obligations and which controls it puts on the clock.
3 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourcebleepingcomputer.com
Open sourcetherecord.media
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The US Department of Justice has indicted 54 alleged members of the Venezuelan Tren de Aragua gang for orchestrating a widespread ATM jackpotting campaign across the United States using a variant of the Ploutus malware. The group is accused of physically tampering with ATMs at banks and credit unions, either by installing malware-laden hard drives or deploying the malware via external devices, enabling them to force machines to dispense large sums of cash. The attacks, which reportedly began in early 2024, targeted dozens of ATMs, with some financial institutions suffering losses exceeding $100,000 and at least one credit union in Nebraska losing approximately $300,000. Authorities allege that the gang conducted reconnaissance to identify vulnerable ATMs, circumvented security features, and coordinated attacks in groups. The Justice Department estimates that at least $5.4 million was stolen by the indicted individuals, with an additional $1.4 million in attempted but unsuccessful thefts. The Ploutus malware, first observed in Mexico in 2013, specifically targets the cash-dispensing modules of ATMs, and its deployment in the US marks a significant escalation in organized cyber-enabled financial crime. US officials have labeled Tren de Aragua a "ruthless terrorist organization" and emphasized ongoing efforts to dismantle their operations and protect American financial infrastructure.
Jun 29, 2026
Five Venezuelan nationals pleaded guilty to conspiracy to commit bank larceny after attempting to install malware and jackpot ATMs in Wamego and Manhattan, Kansas. The December 2025 operation failed twice and triggered police alarms; Luis Alberto Velasquez-Artigas received a nine-month prison sentence, while the remaining defendants await sentencing. A related Nebraska case resulted in an eight-year sentence for Juan Manuel Gouveia-Aguilera over conduct tied to more than $3.5 million in ATM losses. Federal investigators link numerous U.S. ATM-jackpotting incidents to the **Ploutus** malware family, which has been active since its discovery in Mexico in 2013. A Ploutus-D variant observed in Latin America targeted Diebold ATMs through KAL's Kalignite multivendor platform, disabled security-monitoring processes, and enabled cash-outs using a physically connected keyboard and time-limited activation code. Authorities report more than 1,900 ATM-jackpotting incidents since 2020 and over $58 million in losses since 2021; prosecutors allege some schemes financed Venezuelan transnational criminal organizations, though available evidence does not conclusively tie Ploutus development to Tren de Aragua.
Sep 4, 2026
The U.S. Treasury Department sanctioned eight alleged Tren de Aragua (TdA) members, two Mexico-based companies, and seven **TRON** cryptocurrency addresses over an ATM-jackpotting operation that allegedly stole more than **$40 million** from U.S. banks. Treasury said the Mexico- and Venezuela-based network used custom malware to force ATMs and interactive teller machines to dispense cash without debiting accounts, causing reported losses of $40.73 million in more than 1,500 attacks through August 2025. Among those designated is alleged malware developer and FBI Top Ten fugitive Anibal Alexander Canelon Aguirre, known as “Prometheus,” as well as alleged senior TdA leader Juan Gabriel Rivas Nunez. Authorities said the group laundered cash-out proceeds through complex cryptocurrency channels to TdA leadership. The seven sanctioned exchange-hosted TRON deposit addresses received approximately $6.1 million from March 2022 and transferred funds onward to TdA-linked wallets. The designations, issued under Executive Orders 13581 and 13224, block U.S.-linked property interests and create secondary-sanctions exposure for foreign financial institutions that knowingly facilitate significant transactions for the listed parties. The Justice Department has indicted 98 people in the alleged nationwide conspiracy since October 2025 on charges including bank fraud, bank burglary, money laundering, and material support.
Sep 30, 2026