OMAHA, Neb. — Federal prosecutors have expanded a sweeping criminal case accusing members of a Venezuelan-based transnational gang of using sophisticated malware to steal millions of dollars from ATMs across the United States, returning a new indictment that charges 31 additional defendants.
As the CU Daily has been reporting, both credit unions and banks have been victimized by the ATM thefts, especially in the Midwestern U.S.
According to the Justice Department, the latest indictment brings the total number of people charged in the investigation to 87. Prosecutors allege the scheme was carried out by members and associates of Tren de Aragua, or TdA, a criminal organization that originated as a Venezuelan prison gang and has since been designated by the United States as a foreign terrorist organization.
The new charges, returned by a federal grand jury in the District of Nebraska, include 32 counts, among them conspiracy to commit bank fraud, conspiracy to commit bank burglary and computer fraud, bank fraud, bank burglary and damage to protected computers, according to the Justice Department’s Office of Public Affairs.
Ploutus Malware Allegedly Used
Authorities say the defendants took part in a nationwide “ATM jackpotting” conspiracy in which criminals install malware on cash machines to force them to dispense money on demand. Court documents allege the group used a variant of malware known as Ploutus to hack into ATMs at banks and credit unions throughout the country.
According to prosecutors, members of the conspiracy traveled in teams using multiple vehicles, first conducting reconnaissance to identify ATM locations and assess external security features. The groups allegedly tested whether alarms or law enforcement responses had been triggered before opening ATM housings and installing the malware.
Prosecutors say the Ploutus malware was deployed in several ways, including by removing and modifying ATM hard drives, replacing them with preloaded drives, or connecting external devices such as thumb drives. Once installed, the malware issued unauthorized commands to the ATM’s cash-dispensing module, forcing machines to release currency. The software was also designed to delete evidence of its presence in an effort to conceal the attacks and mislead bank and credit union employees, according to court records.
The stolen cash was then divided among participants in predetermined shares, prosecutors said.
Attorney General Pamela Bondi said the investigation reflects the Justice Department’s focus on dismantling TdA, which she described as responsible for a wide range of violent and financial crimes.
Earlier Indictments
The most recent indictment follows a Dec. 9, 2025, case charging 22 individuals with offenses including conspiracy to provide material support to a designated foreign terrorist organization, conspiracy to commit bank fraud and burglary, computer-related crimes and money laundering. Prosecutors allege that TdA used jackpotting attacks to steal millions of dollars and then transferred proceeds among members and associates to conceal the source of the funds.
A related indictment returned Oct. 21, 2025, charged 32 defendants and included 56 counts tied to bank fraud, bank burglary, computer fraud and damage to protected computers.
If convicted, defendants face maximum prison sentences ranging from 20 years to as much as 335 years, depending on the charges, the Justice Department said.
According to court filings, Tren de Aragua emerged in the mid-2000s as a prison gang in Venezuela before expanding into a transnational criminal organization with a presence across the Western Hemisphere, including in the United States. Prosecutors say the group’s activities include drug and firearms trafficking, commercial sex trafficking, kidnapping, robbery, fraud and extortion, as well as murder and other violent acts.
The Investigators
Investigators allege that financial crimes targeting U.S. financial institutions, including ATM jackpotting schemes, have become an additional revenue stream for the organization.
The case is being investigated by the FBI’s Omaha Field Office and U.S. Immigration and Customs Enforcement’s Homeland Security Investigations, with assistance from FBI field offices nationwide, the U.S. Secret Service and dozens of state and local law enforcement agencies. Prosecutors from the Justice Department’s Computer Crime and Intellectual Property Section, the U.S. Attorney’s Office for the District of Nebraska and Joint Task Force Vulcan are leading the prosecution.
