A federal grand jury in the District of Nebraska has returned two indictments charging 54 individuals for their roles in a large conspiracy to deploy malware and steal millions of dollars from ATMs in the United States, a crime commonly referred to as “ATM jackpotting.”
An indictment returned on December 9, 2025, charges 22 defendants with offenses corresponding to their role in the conspiracy, including conspiracy to provide material support to terrorists, conspiracy to commit bank fraud, conspiracy to commit bank burglary and fraud and related activity in connection with computers, and conspiracy to commit money laundering. The indictment also alleges that Tren de Aragua has used jackpotting to steal millions of dollars in the United States and then transferred the proceeds among its members and associates to conceal the illegally obtained cash.
One of the individuals named in the Indictment is Jimena Romina Araya Navarro, an alleged Tren de Aragua leader and Venezuelan entertainer who was sanctioned by the U.S. Department of the Treasury’s Office of Foreign Assets Control. OFAC’s press release alleged that Araya Navarro reportedly helped the notorious head of TdA, Hector Rusthenford Guerrero Flores, escape from the Tocorón prison in Venezuela in 2012, and others in this network have laundered money for TdA leaders. Jimena Romina Araya Navarro was indicted by the grand jury for the District of Nebraska for material support to Tren De Aragua for factual allegations stemming from TdA’s nationwide ATM jackpotting scheme that included burglaries of many ATMs located in Nebraska. Jimena Romina Araya Navarro has been publicly photographed at parties and social events with the alleged head of TdA Nino Guerrero.
“As alleged, these defendants employed methodical surveillance and burglary techniques to install malware into ATMs, and then steal and launder money from the machines, in part to fund terrorism and the other far-reaching criminal activities of TDA, a designated Foreign Terrorist Organization,” said Acting Assistant Attorney General Matthew R. Galeotti of the Justice Department’s Criminal Division. “The announcement of charges against 54 individuals today underscores both the scale of the alleged conspiracies and the tenacity of our investigators and prosecutors. The Criminal Division will not tolerate networks of thieves who breach the security of our financial system, including for the nefarious purpose of providing material support to terrorists.”
A related indictment was returned on October 21, 2025. That indictment charges 32 individuals and alleges 56 counts, including one count of conspiracy to commit bank fraud, one count of conspiracy to commit bank burglary and computer fraud, 18 counts of bank fraud, 18 counts of bank burglary, and 18 counts of damage to computers.
If convicted, the defendants face a maximum term of imprisonment ranging between 20 and 335 years.
United States Attorney Lesley Woods said, “Many millions of dollars were drained from ATMs across the United States as a result of this conspiracy and that money is alleged to have gone to Tren de Aragua leaders to fund their terroristic activities and purposes. A tirelessly dedicated team of Nebraska law enforcement agents and officers banded together to identify this vast international criminal network and to follow the money trail of this devastating financial crime back to its terroristic roots in Venezuela. The agents, analysts, detectives, and officers who came together on this case were able to expose this conspiracy from its lowest levels to the alleged mastermind behind the malware that was deployed against American ATMs all across the nation. The members of Nebraska law enforcement who selflessly dedicated themselves to this mission have not only made Nebraska safer from a designated terrorist organization by removing dozens of TdA members from Nebraska but have also dealt a blow to an organization with international reach and impact. This case demonstrates what state, federal, and local law enforcement officers can accomplish when they fully join forces. The United States Attorney’s Office stands ready to fight alongside our law enforcement partners to defeat any threat to national security and to Nebraska’s security. TdA members will find no safe harbor in the State of Nebraska.”
According to court documents, TdA is a violent transnational criminal organization that originated as a prison gang in Venezuela in the mid-2000s. TdA has expanded its criminal network throughout the Western Hemisphere and established a presence in the United States. TdA’s criminal activities include a variety of violent and criminal offenses, including drug trafficking, firearms trafficking, commercial sex trafficking, kidnapping, robbery, theft, fraud, and extortion. TdA members also commit murder, assault, and other acts of violence to enforce and further the organization’s criminal activities. TdA has developed an additional source of revenue stream through financial crimes that target financial institutions throughout the United States, including using jackpotting to steal millions of dollars in cash.
“TdA poses a direct threat to our communities both here in the Midwest and across our country. This violent terrorist organization relies on a wide range of criminal activities to generate revenue supporting their campaigns of violence and terror. This case highlights TdA’s plot to deploy sophisticated malware targeting financial institutions across the U.S., syphoning millions of dollars from American banks to fund acts of terrorism,” said Special Agent in Charge Eugene Kowel of the Federal Bureau of Investigation’s Omaha Field Office. “As criminal enterprises change tactics, we surge resources and adapt accordingly to protect the American people. FBI Omaha will continue standing shoulder to shoulder with our local, state, and federal partners in the fight to dismantle and disrupt the activities of TdA in our neighborhoods and across the globe.”
The alleged conspiracy developed and deployed a variant of malware known as Ploutus, which was used to hack into ATMs and force ATMs to dispense cash. The conspiracy relied on the recruitment of a number of individuals to deploy Ploutus malware nationwide. Members of the conspiracy and TdA would travel in groups, using multiple vehicles, to the locations of targeted banks and credit unions. These groups would conduct initial reconnaissance and take note of external security features at the ATMs.
Following this reconnaissance, the groups would open the hood or door of ATMs and then wait nearby to see whether they had triggered an alarm or a law enforcement response. The groups would then take steps to install malware on the ATMs by removing the hard drive and installing the malware directly, by replacing the hard drive with one that had been pre-loaded with the Ploutus malware, or by connecting an external device, such as a thumb drive that would deploy the malware.
“Tren de Aragua is not just a criminal gang; they are a ruthless terrorist organization that preys on communities, spreads fear, and bankrolls violence across borders. HSI and our law enforcement partners will track you down, break up your networks, and ensure you never find safe harbor in the United States,” said HSI Kansas City Special Agent in Charge Mark Zito. “Our mission is to protect American families from predators who think they can operate with impunity. We will not tolerate foreign terrorists stealing from our citizens and threatening our homeland. Our communities are safer today because of the relentless work of this team, and we are just getting started.”
The Ploutus malware’s primary purpose was to issue unauthorized commands associated with the Cash Dispensing Module of the ATM in order to force withdrawals of currency. The Ploutus malware was also designed to delete evidence of malware in an effort to conceal, create a false impression, mislead, or otherwise deceive employees of the banks and credit unions from learning about the deployment of the malware on the ATM. Members of the conspiracy would then split the proceeds into predetermined portions.
This year, the District of Nebraska has charged a total of 67 TdA members and leaders with a range of federal offenses that include material support to a designated foreign terror organization, sex trafficking of minors, assault, bank burglary, money laundering, damage and unauthorized access to protected computers, bank fraud, and conspiracy to commit the same offenses.
This Operation is part of the Homeland Security Task Force initiative established by Executive Order 14159, Protecting the American People Against Invasion. The HSTF is a whole-of-government partnership dedicated to eliminating criminal cartels, foreign gangs, transnational criminal organizations, and human smuggling and trafficking rings operating in the United States and abroad. Through historic interagency collaboration, the HSTF directs the full might of United States law enforcement towards identifying, investigating, and prosecuting the full spectrum of crimes committed by these organizations, which have long fueled violence and instability within our borders. In performing this work, the HSTF places special emphasis on investigating and prosecuting those engaged in child trafficking or other crimes involving children. The HSTF further utilizes all available tools to prosecute and remove the most violent criminal aliens from the United States.
HSTF Omaha comprises agents and officers from the Federal Bureau of Investigation and Homeland Security Investigations, with the prosecution being led by the United States Attorney’s Office for the District of Nebraska, the Justice Department’s Computer Crime and Intellectual Property Section, and Joint Task Force Vulcan. The Department of Justice’s Office of International Affairs, as well as the U.S. Attorney’s Offices for the Western District of Washington, Eastern District of California, the Southern District of New York, the Northern District of Illinois, the Central District of Illinois, the Eastern District of Oklahoma, District of New Mexico, Southern District of Florida, and the Eastern District of Wisconsin and have provided significant assistance.
Joint Task Force Vulcan was created in 2019 to eradicate MS-13 and now expanded to target Tren de Aragua, and is comprised of U.S. Attorney’s Offices across the country. Those include Southern and Eastern Districts of New York; Eastern and Western Districts of North Carolina; Eastern and Western Districts of Virginia; Southern District of Florida; Eastern District of Texas; Western District of Oklahoma; Northern District of Indiana; and the District of Nevada, as well as the Executive Office for U.S. Attorneys, Department of Justice’s National Security Division and the Criminal Division. Additionally, the FBI, DEA, HSI, ATF, USMS, and the Federal Bureau of Prisons are essential law enforcement partners with JTFV. The Justice Department’s Office of International Affairs and the Criminal Division’s Office of Judicial Attaché in Bogotá, Colombia, has also provided significant assistance.
FBI’s Omaha Field Office and HSI Omaha is investigating the case, with assistance from FBI’s Sacramento, Seattle, Springfield, Miami, and Oklahoma Field Offices, and the United States Secret Service, United States Marshals Service, Customs and Border Patrol, Immigration and Customs Enforcement, Federal Housing Finance Agency Office of the Inspector General, Financial Deposit Insurance Corporation, and others.
Editor’s Note: Do you enjoy Townhall’s conservative reporting that takes on the radical left and woke media? Support our work so that we can continue to bring you the truth.
Join Townhall VIP and use the promo code FIGHT to get 60% off your VIP membership!
Join the conversation as a VIP Member