LINCOLN, Neb. — A federal grand jury in Nebraska has indicted 54 people accused of taking part in a sweeping international conspiracy that used malware to break into ATM machines and steal millions of dollars across the United States, in a scheme prosecutors say helped finance a violent foreign terrorist organization.
U.S. Attorney Lesley A. Woods said two indictments returned in the District of Nebraska allege the defendants carried out so-called “ATM jackpotting,” in which malicious software is used to force machines to dispense cash.
An indictment returned Dec. 9 charges 22 defendants with offenses including conspiracy to provide material support to terrorists, conspiracy to commit bank fraud, conspiracy to commit bank burglary, computer fraud and money laundering.
Venezuela-Based Gang
Prosecutors allege the crimes were carried out for the benefit of Tren de Aragua, or TdA, a Venezuelan-based criminal organization designated by the U.S. as a Foreign Terrorist Organization.
Among those charged is Jimena Romina Araya Navarro, an alleged TdA leader and Venezuelan entertainer previously sanctioned by the U.S. Treasury Department’s Office of Foreign Assets Control. Prosecutors allege Araya Navarro provided material support to TdA in connection with the nationwide ATM attacks, including burglaries in Nebraska.
A related indictment returned Oct. 21 charges 32 additional defendants with 56 counts, including conspiracy, bank fraud, bank burglary and damage to protected computers.
If convicted, defendants could face sentences ranging from up to 20 years to as much as 335 years in prison, prosecutors said.
‘Methodical Surveillance’
Acting Assistant Attorney General Matthew R. Galeotti said the defendants used “methodical surveillance and burglary techniques” to install malware on ATMs and launder stolen cash, “in part to fund terrorism and the other far-reaching criminal activities” of TdA.
According to court documents, TdA originated as a Venezuelan prison gang in the mid-2000s and has expanded throughout the Western Hemisphere, including into the United States. Authorities say the group engages in drug trafficking, firearms offenses, sex trafficking, kidnapping, robbery, fraud and extortion, along with murder and other acts of violence.
Ploutus Malware Allegedly Used
Prosecutors allege the conspiracy deployed a malware variant known as Ploutus, which allowed attackers to take control of ATM cash-dispensing modules while erasing evidence of the intrusion. Teams traveled to targeted banks and credit unions, conducted surveillance, installed the malware and divided the stolen proceeds.
