Federal grand jury in Nebraska indicts 54 people in massive ATM jackpotting scheme

LINCOLN, Neb. (KOLN) - A federal grand jury in the District of Nebraska has returned two indictments charging 54 people with roles in a large conspiracy to deploy malware and steal millions of dollars from ATMs in the United States, a crime commonly referred to as “ATM jackpotting.”

U.S. Attorney Lesley Woods’ office said Thursday that an indictment returned Dec. 9 charges 22 defendants with offenses corresponding to their roles in the conspiracy, including conspiracy to provide material support to terrorists, conspiracy to commit bank fraud, conspiracy to commit bank burglary and fraud and related activity in connection with computers, and conspiracy to commit money laundering.

The indictment also alleges that Tren de Aragua, also known as TdA, has used jackpotting to steal millions of dollars in the United States and then transferred the proceeds among its members and associates to conceal the illegally obtained cash.

Jimena Romina Araya Navarro, an alleged Tren de Aragua leader and Venezuelan entertainer who was sanctioned by the U.S. Department of the Treasury’s Office of Foreign Assets Control, was named in the indictment.

Araya Navarro reportedly helped the head of TdA, Hector Rusthenford Guerrero Flores, escape from the Tocorón prison in Venezuela in 2012, and others in this network have laundered money for TdA leaders.

Araya Navarro was indicted by the grand jury for the District of Nebraska on charges of providing material support to Tren de Aragua based on allegations stemming from TdA’s nationwide ATM jackpotting scheme that included burglaries of many ATMs located in Nebraska.

A related indictment returned on Oct. 21 charges 32 people and alleges 56 counts, including one count of conspiracy to commit bank fraud, one count of conspiracy to commit bank burglary and computer fraud, 18 counts of bank fraud, 18 counts of bank burglary and 18 counts of damage to computers.

If convicted, the defendants face a maximum term of imprisonment ranging from 20 to 335 years.

“The members of Nebraska law enforcement who selflessly dedicated themselves to this mission have not only made Nebraska safer from a designated terrorist organization by removing dozens of TdA members from Nebraska but have also dealt a blow to an organization with international reach and impact,” Woods’ office said.

Woods’ office said the alleged conspiracy developed and deployed a variant of malware known as Ploutus, which was used to hack into ATMs nationwide and force ATMs to dispense cash.

Members of the conspiracy and TdA would allegedly travel in groups, using multiple vehicles, to the locations of targeted banks and credit unions. These groups would open the hood or door of ATMs and then wait nearby to see whether they had triggered an alarm or a law enforcement response, Woods’ office said.

The steps included installing malware on the ATMs, Woods’ office said.

The Ploutus malware’s primary purpose was to issue unauthorized commands associated with the cash-dispensing module of the ATM in order to force withdrawals of currency.

According to Woods, members of the conspiracy would then split the proceeds in predetermined portions.

The following is a visual representation of alleged jackpotting incidents across the United States and their total loss amounts as of August 2025: