Executive Summary
- Federal grand jury indicts six more individuals in Nebraska for ATM jackpotting.
- Investigation links the scheme to the Tren de Aragua (TdA) gang with 93 total defendants charged.
- Conspirators allegedly used "Ploutus" malware to steal over $6 million from U.S. ATMs.
- Defendants face charges of bank fraud, burglary, and damage to computers.
LINCOLN, Neb. — A federal grand jury in the District of Nebraska has returned an indictment charging six individuals for their alleged involvement in a widespread conspiracy to deploy malware and steal millions of dollars from ATMs across the United States, according to federal prosecutors. The charges, announced by U.S. Attorney Lesley Woods’ office on Friday, link the defendants to the transnational criminal organization Tren de Aragua (TdA).
The indictment, returned on Wednesday, brings the total number of defendants charged in this ongoing investigation to 93, following previous indictments unsealed in December 2025 and January 2026. Prosecutors state that the six new defendants face charges corresponding to their specific roles in the operation, including conspiracy to commit bank fraud, conspiracy to commit bank burglary and computer fraud, bank fraud, and damage to protected computers. The U.S. Attorney’s office alleges that the group utilized a technique known as "ATM jackpotting" to illicitly withdraw cash.
According to court filings, the conspiracy developed and deployed a variant of malware known as "Ploutus." Investigators detailed that this software was used to hack into ATMs nationwide, issuing unauthorized commands to the cash-dispensing modules to force the release of currency. The indictment alleges that TdA members used these methods to steal over $6 million from financial institutions, with at least an additional $1.74 million in attempted thefts.
U.S. Attorney Woods’ office described a coordinated modus operandi in which members of the conspiracy traveled in groups, utilizing multiple vehicles, to target banks and credit unions. Allegedly, these groups would physically breach the hood or door of an ATM and wait nearby to detect any law enforcement response before installing the malware. Once the machines dispensed the cash, the proceeds were reportedly transferred and split among members and associates of the TdA organization to conceal the funds.
It is important to note that an indictment is a formal accusation, and all individuals are presumed innocent until proven guilty in a court of law. If convicted, the defendants face maximum prison terms ranging from 20 to 335 years depending on their specific charges.
Investigative Outlook
The indictment of nearly 100 individuals in connection with the Tren de Aragua ATM jackpotting scheme signals a significant shift in federal law enforcement strategy regarding organized retail and cyber-enabled crime. By prosecuting these cases under federal conspiracy and computer fraud statutes, the Department of Justice appears focused on dismantling the financial lifelines of transnational gangs operating within U.S. borders. The case highlights the evolving technical sophistication of criminal organizations like TdA, which have moved beyond traditional street crimes to complex financial fraud, necessitating heightened cybersecurity protocols for banking infrastructure nationwide.
