Two Venezuelan nationals were sentenced to federal prison after prosecutors tied an ATM malware scheme to the Tren de Aragua criminal network and secured restitution orders and wider indictments.
Two Venezuelan nationals pleaded guilty and received lengthy federal sentences after investigators say they helped deploy ATM-targeting malware that allowed co-conspirators to force cash dispensers to spit out millions. Carlos Javier Padron, 36, was sentenced yesterday to 78 months in prison for his role in the plot, and his co-defendant, Oddry Arnoldo Cabrera Torrealba, also known as “Luis Alejandro Berdugo Barraza,” 37, received 78 months on June 11. Authorities say the scheme is tied to the violent transnational group Tren de Aragua, often abbreviated TdA.
Court filings describe a coordinated network that developed and installed a variant of malware called Ploutus on ATMs to enable unauthorized withdrawals. The malware was designed to accept remote commands to the cash dispensing module and to erase traces of its presence so banks would have trouble detecting the thefts. Padron and Torrealba were arrested by Lincoln, Nebraska police at the site of an October 2024 jackpotting operation.
Prosecutors say the Ploutus variant was central to a transnational conspiracy that stole millions of dollars from ATMs across the United States. The scheme relied on in-person installs by actors like Padron and Torrealba to get the malware onto machines, then used that foothold to trigger large cash dumps. The court ordered both men to pay $1,537,696 in restitution to victim banks, jointly.
Assistant Attorney General A. Tysen Duva of the Justice Department’s Criminal Division said, “Crimes like this undermine the security of our financial institutions and fuel the operations of violent transnational criminal organizations such as Tren de Aragua (TdA). This sweeping investigation with the District of Nebraska and our law enforcement partners has disrupted this network at all levels. We will protect our financial institutions from technology-enabled fraud.”
U.S. Attorney Lesley Woods for the District of Nebraska added a sharp focus on TdA’s funding. “ATM jackpotting is TdA’s business plan and their assessed primary source of revenue to fund their terrorist activities that range from reprehensible forms of human trafficking to armed robbery, murder, and the general undermining of America’s national security by flooding our communities with controlled substances,” she said. Prosecutors framed these prosecutions as a way to choke off the group’s cash flow.
FBI Omaha’s Special Agent in Charge Euguene Cowel described TdA as a violent terrorist organization that uses diverse criminal enterprises to fund terror. “As criminal enterprises change tactics, we surge resources and adapt accordingly to protect the American people,” he said. The FBI emphasized continuing joint work with local, state, and federal partners to dismantle and disrupt TdA both locally and abroad.
Acting Special Agent in Charge Rick Sabatini of ICE Homeland Security Investigations Kansas City stressed the domestic threat posed by the funding. “These individuals participated in a crime that was both an attack on the American financial system, and an effort by Tren De Aragua to fund even more terror in our country,” he said. HSI highlighted the interagency cooperation that led to the arrests and the attempt to restore consumer confidence in banks.
The federal inquiry did not end with the two arrests. Following Padron and Torrealba’s detention, investigators identified a sprawling network of co-conspirators across the United States and internationally. Authorities have since charged dozens more, with 96 other defendants indicted for related offenses that include material support to a designated foreign terror organization, bank burglary, money laundering, and computer crimes.
Documentation in the case traces TdA’s origin from a Venezuelan prison gang in the mid-2000s to a transnational criminal organization with a presence across the Western Hemisphere. TdA’s criminal portfolio reportedly includes drug and firearms trafficking, commercial sex trafficking, kidnapping, robbery, fraud, extortion, and violent acts such as murder and assault. Financial crimes like ATM jackpotting have become an additional revenue stream for the group.
The prosecutions are joint efforts by the Criminal Division’s Computer Crime and Intellectual Property Section and the U.S. Attorney’s Office for the District of Nebraska, supported by a long list of federal, state, and local partners. Investigations involved multiple U.S. Attorney’s Offices, Joint Task Force Vulcan, the FBI, HSI, ATF, USMS, and state law enforcement agencies. The cooperative approach reflects a broader push to target transnational gangs that exploit technological tools to profit from American communities.
Joint Task Force Vulcan, created originally to combat MS-13, has been broadened at the direction of the Attorney General to confront TdA and similar networks. JTFV now brings together U.S. Attorney’s Offices across the country, DOJ components, international partners, and federal law enforcement to coordinate prosecutions and investigations. Task force members emphasized that attacking criminal finance streams is a critical way to weaken violent organizations.
The Computer Crime and Intellectual Property Section noted its long track record in cyber prosecutions, where convictions and court orders have returned substantial victim funds in recent years. Since 2020, CCIPS reports convictions of more than 180 cyber and IP criminals and orders for the return of over $350 million to victims. That experience was a key resource in dismantling a sophisticated Ploutus-based jackpotting operation.
The sentences in this case reflect the criminal justice consequences for deploying malware to steal bank cash and for aiding a violent transnational criminal organization. Padron and Torrealba each face significant prison time, restitution payments, and the legal aftermath of federal conspiracy and computer fraud convictions. Prosecutors say they will continue targeting networks that blend cyber tools and old-fashioned violence to fund their crimes.
Investigators and prosecutors framed the operation as part of a larger homeland security initiative tied to Executive Order 14159, Protecting the American People Against Invasion, and to a Homeland Security Task Force effort. That whole-of-government approach prioritizes disrupting cartels, foreign gangs, and human smuggling and trafficking rings operating in the United States and abroad. Officials emphasized special attention to violent criminal aliens and crimes involving children as enforcement priorities.
The case shows how technology-enabled theft can intersect with organized criminal violence to create a national security problem as much as a financial crime. By tying ATM jackpotting to Tren de Aragua, prosecutors argued they were striking at both the method and the money behind more violent criminal ventures. The federal response is likely to continue, with coordinated enforcement aimed at disrupting similar schemes in the future.
