Federal authorities have charged 87 individuals in a sophisticated ATM hacking operation orchestrated by the Venezuelan gang Tren de Aragua, exposing how lax border policies allowed foreign criminals to exploit America’s aging financial infrastructure and funnel millions into funding human trafficking and murder.
Story Snapshot
- 87 individuals charged in multi-state ATM jackpotting scheme tied to Venezuelan gang Tren de Aragua, with 31 new indictments announced in January 2026
- Gang members used Ploutus malware to hack outdated Windows XP ATMs, forcing machines to dispense all cash in coordinated attacks across at least 1,529 incidents
- Stolen funds bankrolled terrorism including human trafficking, child sex trafficking, kidnapping, and murder according to federal prosecutors
- Operation spanned South Carolina, Georgia, North Carolina, Virginia, and Nebraska with losses reaching millions of dollars from compromised bank-owned machines
Foreign Gang Exploits Outdated American ATMs
The U.S. Attorney’s Office for the District of Nebraska announced 31 additional indictments in late January 2026, bringing total defendants to 87 in a nationwide ATM jackpotting conspiracy linked to Tren de Aragua. The Venezuelan gang targeted legacy ATMs running Windows XP operating systems, physically accessing machines after business hours to install Ploutus malware via laptops, USB drives, or hard drive replacements. This malware forced ATMs to dispense their entire cash reserves, with individual machines yielding between $100,000 and $300,000 per attack. The sophisticated operation involved reconnaissance, physical tampering, evidence deletion, and coordinated cash collection across multiple states.
🚨 BREAKING: Massive bust, 31 Tren de Aragua gang members nabbed for ATM jackpotting & infecting banks with malware to steal MILLIONS.
31 Democrat heroes going to prison. pic.twitter.com/fbbS9wWlh3
— Gunther Eagleman™ (@GuntherEagleman) January 26, 2026
Terrorist Organization Funds Criminal Enterprise Through Theft
Tren de Aragua originated as a Venezuelan prison gang in the 2010s before evolving into a transnational criminal organization that the United States designated as a foreign terrorist organization. U.S. Attorney Lesley A. Woods stated the stolen millions fueled “human trafficking, sex trafficking of children, kidnapping, murder” across communities. Deputy Attorney General Todd Blanche pledged that “Joint Task Force Vulcan will not stop until it completely dismantles” Tren de Aragua, signaling the administration’s commitment to eradicating this threat. The gang’s expansion into sophisticated cyber-physical financial crimes demonstrates how unchecked illegal immigration enabled dangerous foreign actors to establish criminal operations on American soil.
Multi-State Investigation Reveals Massive Criminal Network
Federal investigators documented at least 1,529 ATM jackpotting incidents across South Carolina, Georgia, North Carolina, Virginia, and Nebraska, with the U.S. Secret Service, South Carolina Law Enforcement Division, and Homeland Security Task Force coordinating the multi-state investigation. The operation involved 32 counts including bank fraud, burglary, and computer fraud against the 87 defendants. Previous arrests included guilty pleas in September 2025 when David Josfrangel Suarez-Sanchez admitted to conspiracy to commit bank fraud in the Middle District of Georgia. January 2026 saw sentencing and deportation orders for Venezuelan nationals Luz Granados and Johan Gonzalez-Jimenez in related southeastern cases, demonstrating coordinated enforcement efforts under the new administration’s policies.
Legacy Banking Infrastructure Creates Vulnerability
The scheme specifically exploited banks and credit unions operating outdated ATMs with weak physical security features such as inadequate alarm systems and insufficient protective casings. Cybersecurity forensic analysis mapped the gang’s tactics to established attack frameworks, documenting how Ploutus malware enabled remote SMS activation, persistent system access, defensive evasion through log deletion, and systematic cash exfiltration. This case underscores urgent security gaps created when financial institutions defer critical infrastructure upgrades. The attacks highlight a broader pattern where criminals adapted Latin American ATM exploitation techniques for deployment against vulnerable American targets, capitalizing on institutions that failed to modernize equipment or implement robust physical security measures that would prevent unauthorized access to sensitive banking hardware.
Sources:
ATM Jackpotting Attack: Tren de Aragua Gang Exploits Ploutus Malware on Legacy Windows XP ATMs in US
Feds charge 87 individuals in massive ATM ‘jackpotting’ operation linked to Tren de Aragua gang
DOJ charges 31, including alleged Tren de Aragua members, in ATM malware case
87 charged in nationwide ATM jackpotting scheme tied to Tren de Aragua gang
DOJ charges 31, including alleged Tren de Aragua members, in ATM malware case
Investigation into International “ATM Jackpotting” Scheme and Tren de Aragua Results in Additional Indictment and 87 Total Charged Defendants
Multi-State ATM Jackpotting Ring Busted in the Middle District of Georgia
