DOJ Charges 31 More in ATM ‘Jackpotting’ Terror Scheme Tied to Venezuelan Tren de Aragua

A federal grand jury in Nebraska indicted 31 additional suspects — many of them Venezuelan and Colombian nationals linked to the violent Tren de Aragua gang — for a nationwide ATM “jackpotting” conspiracy that prosecutors say funneled millions of stolen dollars into a foreign terrorist organization operating inside the United States. This brings the total number of defendants in this scheme to 87, officials stated.

The Justice Department has unsealed a sweeping new indictment accusing 31 additional defendants of participating in the well-coordinated ATM jackpotting conspiracy that officials say funded a terrorist organization known as Tren de Aragua (TdA). The new indictments, released on Monday by the U.S. Attorney for the District of Nebraska, include 32 counts of conspiracy to commit bank fraud, conspiracy to commit bank burglary and computer fraud, bank fraud, bank burglary, and computer damage.

“A large ring of criminal aliens allegedly engaged in a nationwide conspiracy to enrich themselves and the TdA terrorist organization by ripping off American citizens. After committing bank robbery, fraud, and other serious crimes, they will be vigorously prosecuted and held accountable for their crimes,” Deputy Attorney General Todd Blanche said in the written statement. “The Justice Department’s Joint Task Force Vulcan will not stop until it completely dismantles and destroys TdA and other foreign terrorists that import chaos to America.”

Prosecutors report:

The alleged conspiracy developed and deployed a variant of malware known as Ploutus, which was used to hack into ATMs and force ATMs to dispense cash. The conspiracy relied on the recruitment of a number of individuals to deploy Ploutus malware nationwide. Members of the conspiracy and TdA would travel in groups, using multiple vehicles, to the locations of targeted banks and credit unions. These groups would conduct initial reconnaissance and take note of external security features at the ATMs. Following this reconnaissance, the groups would open the hood or door of ATMs and then wait nearby to see whether they had triggered an alarm or a law enforcement response. The groups would then take steps to install malware on the ATMs, by removing the hard drive and installing the malware directly, by replacing the hard drive with one that had been pre-loaded with the Ploutus malware, or by connecting an external device such as a thumb drive that would deploy the malware. The Ploutus malware’s primary purpose was to issue unauthorized commands associated with the Cash Dispensing Module of the ATM in order to force withdrawals of currency. The Ploutus malware was also designed to delete evidence of malware in an effort to conceal, create a false impression, mislead, or otherwise deceive employees of the banks and credit unions from learning about the deployment of the malware on the ATM. Members of the conspiracy would then split the proceeds in predetermined portions.

“Tren de Aragua uses ATM jackpotting crimes committed all across America to fund its terrorist organization, which is responsible for horrific crimes such as human trafficking (to include sex trafficking of children in Nebraska), kidnapping, murder and other unspeakably evil and violent acts, U.S. Attorney Lesley A. Woods for the District of Nebraska added. “The U.S. Attorney’s Office for the District of Nebraska will fight TdA directly by taking every action at our disposal to shut down their financial pipeline and handicap their ability to terrorize American communities.”

In December 2025, Breitbart Texas reported that 54 alleged TdA members were indicted in the District of Nebraska in connection to the ATM “jackpotting” scheme.

The first indictment, returned December 9, 2025, charges 22 defendants with crimes including conspiracy to provide material support to terrorists, conspiracy to commit bank fraud and bank burglary, computer‑related fraud, and money laundering. Prosecutors allege that TdA used the jackpotting scheme as a revenue stream to support its broader criminal activities, which span drug trafficking, extortion, kidnapping, and acts of violence throughout the Western Hemisphere.

The first indictment, returned December 9, 2025, charges 22 defendants with crimes including conspiracy to provide material support to terrorists, conspiracy to commit bank fraud and bank burglary, computer‑related fraud, and money laundering. Prosecutors allege that TdA used the jackpotting scheme as a revenue stream to support its broader criminal activities, which span drug trafficking, extortion, kidnapping, and acts of violence throughout the Western Hemisphere.

Another indictment, released in October, brought similar charges against 32 others.

“This latest indictment demonstrates the Criminal Division’s commitment to dismantling cartels, including when they attack our nation’s financial systems with sophisticated malware,” Assistant Attorney General A. Tysen Duva of the Justice Department’s Criminal Division concluded. “The announcement of charges against a total of 87 defendants underscores both the massive scale of these alleged conspiracies and the strength and skill of our investigators and prosecutors who dismantle them. As cartels level up their criminal game, so will we.”

In the end, the Nebraska indictment makes one thing unmistakably clear: Tren de Aragua is no longer just a foreign menace slipping across the border — it is a fully evolved terrorist organization running cyber‑enabled financial attacks deep inside the United States. Federal agents say the group’s ATM‑jackpotting crews weren’t just stealing cash; they were siphoning American money to bankroll kidnapping, child‑sex trafficking, and murder. With 87 defendants now charged and more arrests expected, prosecutors insist this is only the opening salvo in a long‑term campaign to dismantle TdA’s U.S. footprint and choke off the criminal pipelines that fuel its violence.