Loading story…
Five Venezuelan nationals pleaded guilty to conspiracy to commit bank larceny after attempting to install malware and jackpot ATMs in Wamego and Manhattan, Kansas. The December 2025 operation failed twice and triggered police alarms; Luis Alberto Velasquez-Artigas received a nine-month prison sentence, while the remaining defendants await sentencing. A related Nebraska case resulted in an eight-year sentence for Juan Manuel Gouveia-Aguilera over conduct tied to more than $3.5 million in ATM losses.
Federal investigators link numerous U.S. ATM-jackpotting incidents to the Ploutus malware family, which has been active since its discovery in Mexico in 2013. A Ploutus-D variant observed in Latin America targeted Diebold ATMs through KAL's Kalignite multivendor platform, disabled security-monitoring processes, and enabled cash-outs using a physically connected keyboard and time-limited activation code. Authorities report more than 1,900 ATM-jackpotting incidents since 2020 and over $58 million in losses since 2021; prosecutors allege some schemes financed Venezuelan transnational criminal organizations, though available evidence does not conclusively tie Ploutus development to Tren de Aragua.
See the reporting duties and controls this puts on the clock.
9 events from the most recent confirmed update back to the earliest known activity.
The FBI warned that ATM jackpotting incidents were increasing across the United States, reporting more than 1,900 incidents since 2020. It said that more than 700 incidents in 2025 caused over $20 million in losses.
Five Venezuelan nationals drove from Indiana to Wamego and Manhattan, Kansas, and allegedly attempted to install malware on ATMs to trigger cash dispensing. Both attempts failed and activated police alarms; surveillance footage contributed to the group's arrests days later.
Diebold Nixdorf issued a further alert concerning Ploutus variants used in Mexico and the United States.
Diebold Nixdorf issued an alert concerning Ploutus variants used against ATMs in Mexico and the United States.
Ploutus was first detected and initially deployed against ATMs in Mexico, enabling cash-outs without an ATM card through an externally connected keyboard or SMS messages.
Oddry Arnoldo Cabrera Torrealba and Carlos Javier Padron each received 6.5-year prison sentences for connections to the broader ATM-jackpotting scheme.
A federal judge in Omaha sentenced Juan Manuel Gouveia-Aguilera to eight years in prison for bank fraud and computer-fraud-related conduct associated with more than $3.5 million in ATM losses. He was also ordered to complete five years of supervised release and pay restitution.
Five Venezuelan nationals pleaded guilty in Kansas federal court to conspiracy to commit bank larceny over the attempted ATM-jackpotting scheme. Luis Alberto Velasquez-Artigas received a nine-month prison sentence, while four co-defendants awaited sentencing.
FireEye Labs identified the previously unobserved Ploutus-D variant in the wild. The variant integrates with KAL's Kalignite platform, targets Diebold ATMs, and uses a launcher to kill security-monitoring processes.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See what this changes for your reporting obligations and which controls it puts on the clock.
10 references tracked. Mallory keeps watching after this page renders.
infosec.pub
Open sourcecybersecuritynews.com
Open sourcesecurityaffairs.com
Open sourcesecurityweek.com
Open sourcecloud.google.com
Open sourcecommunity.broadcom.com
Open sourcecommunity.broadcom.com
Open sourcecyber.nj.gov
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The US Department of Justice has indicted 54 alleged members of the Venezuelan Tren de Aragua gang for orchestrating a widespread ATM jackpotting campaign across the United States using a variant of the Ploutus malware. The group is accused of physically tampering with ATMs at banks and credit unions, either by installing malware-laden hard drives or deploying the malware via external devices, enabling them to force machines to dispense large sums of cash. The attacks, which reportedly began in early 2024, targeted dozens of ATMs, with some financial institutions suffering losses exceeding $100,000 and at least one credit union in Nebraska losing approximately $300,000. Authorities allege that the gang conducted reconnaissance to identify vulnerable ATMs, circumvented security features, and coordinated attacks in groups. The Justice Department estimates that at least $5.4 million was stolen by the indicted individuals, with an additional $1.4 million in attempted but unsuccessful thefts. The Ploutus malware, first observed in Mexico in 2013, specifically targets the cash-dispensing modules of ATMs, and its deployment in the US marks a significant escalation in organized cyber-enabled financial crime. US officials have labeled Tren de Aragua a "ruthless terrorist organization" and emphasized ongoing efforts to dismantle their operations and protect American financial infrastructure.
Jun 29, 2026
US prosecutors unsealed a federal grand jury indictment charging **31 additional defendants** for allegedly participating in an **ATM “jackpotting”** conspiracy that used **Ploutus** malware to force ATMs to dispense cash until empty. Court filings and DOJ statements describe a hands-on tradecraft: crews surveilled target ATMs, opened housings to test alarm response, then either swapped hard drives with preloaded ones or used USB devices to deploy the malware; the tooling also supported evidence deletion to hinder investigations. Authorities allege the operation stole at least **$5.4 million from 63 ATMs** (many at credit unions) over a period spanning **Feb 2024–Dec 2025**, with proceeds split and moved among participants to facilitate laundering. The DOJ and reporting link parts of the conspiracy to **Tren de Aragua (TdA)**, a Venezuelan transnational criminal organization that the US Treasury’s **OFAC** designated as a **Foreign Terrorist Organization** (per the cited coverage), and the latest indictment follows earlier rounds of charges against dozens of suspects for related conduct (including bank fraud, bank burglary, computer fraud, and damage to computers). Separate reporting in this set covers unrelated law-enforcement actions involving an alleged **hitman-for-hire** website in Romania and arrests in the Netherlands tied to a **$1.6M NFT theft**; those cases do not appear connected to the Ploutus ATM malware conspiracy.
Jun 29, 2026
U.S. authorities reported multiple enforcement actions against financially motivated cybercrime. In South Carolina, two Venezuelan nationals convicted in an **ATM jackpotting** scheme will be deported after serving their sentences; prosecutors said they physically accessed older ATM models, connected a laptop, and installed malware that bypassed security controls to force cash-out until the machines were emptied. The activity impacted banks across several southeastern states, with court-ordered restitution of **$285,100** and **$126,340** respectively, and investigators said evidence from the case contributed to a broader Nebraska indictment of dozens of individuals tied to a larger ATM-theft conspiracy. Separately, a Russian national, **Ianis Aleksandrovich Antropenko**, pleaded guilty in federal court to **conspiracy to commit money laundering** and **conspiracy to commit computer fraud and abuse** for leading a ransomware operation that targeted at least 50 victims over a four-year period ending in August 2022; he faces up to **25 years** in prison, financial penalties, restitution, and forfeiture, and the plea acknowledges potential immigration consequences. A third item describes convicted Bitcoin thief **Ilya Lichtenstein** seeking post-release work in cybersecurity, but it is not tied to the ATM jackpotting or Antropenko ransomware case and does not add incident-specific threat intelligence.
Jun 29, 2026