Over 50 Tren de Aragua Gang Members Imported Under Democrats Indicted in Nebraska in Massive Nationwide ATM Jackpotting Scheme
by
Federal prosecutors have charged 54 members and associates of the Venezuelan terrorist gang Tren de Aragua (TdA) in a sweeping, multi-state criminal conspiracy that siphoned millions of dollars from American ATMs.
According to United States Attorney Lesley A. Woods, a federal grand jury in the District of Nebraska returned two major indictments charging dozens of TdA operatives in a massive nationwide “ATM jackpotting” conspiracy that siphoned millions of dollars from American banks to fund terrorism, violence, and organized crime.
The first indictment, returned on December 9, 2025, charges 22 defendants with crimes including:
Conspiracy to provide material support to a designated foreign terrorist organization
Conspiracy to commit bank fraud and bank burglary
Computer fraud and related activity
Money laundering
Federal prosecutors allege that Tren de Aragua used sophisticated malware attacks—known as ATM “jackpotting”—to force machines to dispense cash on demand. The stolen money was then laundered and transferred among TdA members to conceal its origins and bankroll the group’s violent operations.
A second, related indictment returned on October 21, 2025, charges 32 additional defendants across 56 felony counts, including bank fraud, bank burglary, computer fraud, and destruction of protected computers.
If convicted, some defendants face sentences ranging from 20 years to an astounding 335 years in federal prison.
The alleged conspiracy developed and deployed a variant of malware known as Ploutus, which was used to hack into ATMs and force ATMs to dispense cash. The conspiracy relied on the recruitment of a number of individuals to deploy Ploutus malware nationwide.
Members of the conspiracy and TdA would travel in groups, using multiple vehicles, to the locations of targeted banks and credit unions.
These groups would conduct initial reconnaissance and take note of external security features at the ATMs.
Following this reconnaissance, the groups would open the hood or door of ATMs and then wait nearby to see whether they had triggered an alarm or a law enforcement response.
The groups would then take steps to install malware on the ATMs, by removing the hard drive and installing the malware directly, by replacing the hard drive with one that had been pre-loaded with the Ploutus malware, or by connecting an external device such as a thumb drive that would deploy the malware.
The Ploutus malware’s primary purpose was to issue unauthorized commands associated with the Cash Dispensing Module of the ATM in order to force withdrawals of currency.
The Ploutus malware was also designed to delete evidence of malware in an effort to conceal, create a false impression, mislead, or otherwise deceive employees of the banks and credit unions from learning about the deployment of the malware on the ATM.
Members of the conspiracy would then split the proceeds in predetermined portions.
The following photographs depict just a few of the alleged ATM burglaries in progress:
Screenshot: DOJ
The following is a visual representation of the location of alleged jackpotting incidents committed across the United States, along with their geographical locations and total loss amounts as of August, 2025:
One of the most explosive revelations involves Jimena Romina Araya Navarro, an alleged TdA leader and Venezuelan entertainer already sanctioned by the U.S. Treasury Department’s Office of Foreign Assets Control (OFAC).
According to Treasury officials, Araya Navarro allegedly helped TdA kingpin Héctor Rusthenford Guerrero Flores—aka “Niño Guerrero”—escape from Venezuela’s notorious Tocorón prison in 2012. She has also been publicly photographed socializing with Guerrero at parties and events.
Araya Navarro is now indicted in Nebraska on charges of providing material support to Tren de Aragua, stemming from her alleged role in coordinating and funding ATM jackpotting operations that included burglaries across Nebraska.
