A federal grand jury in Nebraska returned indictments that allege a widespread ATM jackpotting conspiracy tied to the Venezuelan group Tren de Aragua, resulting in 54 individuals charged with schemes that moved millions of dollars and reached across the United States.
A federal grand jury in the District of Nebraska has returned two indictments charging 54 individuals for their roles in a large conspiracy to deploy malware and steal millions of dollars from ATMs in the United States, a crime commonly referred to as “ATM jackpotting.” The charges allege a coordinated effort to install malware, steal cash from machines, and move proceeds through a web of accounts and associates to hide the origin of the funds. Authorities say the scheme crossed multiple states and targeted a range of banks and credit unions.
An indictment returned on December 9, 2025, charges 22 defendants with offenses corresponding to their role in the conspiracy, including conspiracy to provide material support to terrorists, conspiracy to commit bank fraud, conspiracy to commit bank burglary and fraud and related activity in connection with computers, and conspiracy to commit money laundering. The indictment also alleges that Tren de Aragua has used jackpotting to steal millions of dollars in the United States and then transferred the proceeds among its members and associates to conceal the illegally obtained cash. Prosecutors tie the financial activity back to leadership figures and point to coordinated laundering efforts.
One of the individuals named in the Indictment is Jimena Romina Araya Navarro, an alleged Tren de Aragua leader and Venezuelan entertainer who was sanctioned by the U.S. Department of the Treasury’s Office of Foreign Assets Control. OFAC’s press release alleged that Araya Navarro reportedly helped the notorious head of TdA, Hector Rusthenford Guerrero Flores, escape from the Tocorón prison in Venezuela in 2012, and others in this network have laundered money for TdA leaders. Jimena Romina Araya Navarro was indicted by the grand jury for the District of Nebraska for material support to Tren De Aragua for factual allegations stemming from TdA’s nationwide ATM jackpotting scheme that included burglaries of many ATMs located in Nebraska. Jimena Romina Araya Navarro has been publicly photographed at parties and social events with the alleged head of TdA Nino Guerrero.
“As alleged, these defendants employed methodical surveillance and burglary techniques to install malware into ATMs, and then steal and launder money from the machines, in part to fund terrorism and the other far-reaching criminal activities of TDA, a designated Foreign Terrorist Organization,” said Acting Assistant Attorney General Matthew R. Galeotti of the Justice Department’s Criminal Division. “The announcement of charges against 54 individuals today underscores both the scale of the alleged conspiracies and the tenacity of our investigators and prosecutors. The Criminal Division will not tolerate networks of thieves who breach the security of our financial system, including for the nefarious purpose of providing material support to terrorists.”
A related indictment was returned on October 21, 2025. That indictment charges 32 individuals and alleges 56 counts, including one count of conspiracy to commit bank fraud, one count of conspiracy to commit bank burglary and computer fraud, 18 counts of bank fraud, 18 counts of bank burglary, and 18 counts of damage to computers. Together the two indictments paint a picture of repeated and organized attacks on ATMs using a common set of tools and tactics. The stolen funds are alleged to have been routed through multiple associates and accounts to hide their origin.
If convicted, the defendants face a maximum term of imprisonment ranging between 20 and 335 years. United States Attorney Lesley Woods said, “Many millions of dollars were drained from ATMs across the United States as a result of this conspiracy and that money is alleged to have gone to Tren de Aragua leaders to fund their terroristic activities and purposes. A tirelessly dedicated team of Nebraska law enforcement agents and officers banded together to identify this vast international criminal network and to follow the money trail of this devastating financial crime back to its terroristic roots in Venezuela. The agents, analysts, detectives, and officers who came together on this case were able to expose this conspiracy from its lowest levels to the alleged mastermind behind the malware that was deployed against American ATMs all across the nation. The members of Nebraska law enforcement who selflessly dedicated themselves to this mission have not only made Nebraska safer from a designated terrorist organization by removing dozens of TdA members from Nebraska but have also dealt a blow to an organization with international reach and impact. This case demonstrates what state, federal, and local law enforcement officers can accomplish when they fully join forces. The United States Attorney’s Office stands ready to fight alongside our law enforcement partners to defeat any threat to national security and to Nebraska’s security. TdA members will find no safe harbor in the State of Nebraska.”
According to court documents, TdA is a violent transnational criminal organization that originated as a prison gang in Venezuela in the mid-2000s. TdA has expanded its criminal network throughout the Western Hemisphere and established a presence in the United States. TdA’s criminal activities include a variety of violent and criminal offenses, including drug trafficking, firearms trafficking, commercial sex trafficking, kidnapping, robbery, theft, fraud, and extortion.
“TdA poses a direct threat to our communities both here in the Midwest and across our country. This violent terrorist organization relies on a wide range of criminal activities to generate revenue supporting their campaigns of violence and terror. This case highlights TdA’s plot to deploy sophisticated malware targeting financial institutions across the U.S., syphoning millions of dollars from American banks to fund acts of terrorism,” said Special Agent in Charge Eugene Kowel of the Federal Bureau of Investigation’s Omaha Field Office. “As criminal enterprises change tactics, we surge resources and adapt accordingly to protect the American people. FBI Omaha will continue standing shoulder to shoulder with our local, state, and federal partners in the fight to dismantle and disrupt the activities of TdA in our neighborhoods and across the globe.”
The alleged conspiracy developed and deployed a variant of malware known as Ploutus, which was used to hack into ATMs and force ATMs to dispense cash. The conspiracy relied on the recruitment of a number of individuals to deploy Ploutus malware nationwide, and members would travel in groups using multiple vehicles to hit targets. Investigators say the groups conducted surveillance, opened ATM housings, and then installed malware by swapping hard drives, loading pre-infected drives, or attaching external devices like thumb drives to deploy the code.
“Tren de Aragua is not just a criminal gang; they are a ruthless terrorist organization that preys on communities, spreads fear, and bankrolls violence across borders. HSI and our law enforcement partners will track you down, break up your networks, and ensure you never find safe harbor in the United States,” said HSI Kansas City Special Agent in Charge Mark Zito. “Our mission is to protect American families from predators who think they can operate with impunity. We will not tolerate foreign terrorists stealing from our citizens and threatening our homeland. Our communities are safer today because of the relentless work of this team, and we are just getting started.”
The Ploutus malware’s primary purpose was to issue unauthorized commands associated with the Cash Dispensing Module of the ATM in order to force withdrawals of currency. The malware also aimed to delete evidence to mislead bank employees and conceal the deployment, and the proceeds were then split into predetermined shares by co-conspirators. This year, the District of Nebraska has charged a total of 67 TdA members and leaders with a range of federal offenses that include material support to a designated foreign terror organization, sex trafficking of minors, assault, bank burglary, money laundering, damage and unauthorized access to protected computers, bank fraud, and conspiracy to commit the same offenses.
The operation is being handled as a multiagency effort. HSTF Omaha brings together agents from the FBI and Homeland Security Investigations, with prosecutions led by the United States Attorney’s Office for the District of Nebraska, the Justice Department’s Computer Crime and Intellectual Property Section, and Joint Task Force Vulcan. FBI Omaha and HSI Omaha are leading investigations with support from multiple FBI field offices, the United States Secret Service, United States Marshals Service, Customs and Border Protection, Immigration and Customs Enforcement, and other federal partners as the case unfolds.
