Before federal agents ever mentioned terrorism or human trafficking, investigators say they were looking for something more mundane. Dozens of cash machines in different states were drained in minutes, with no evidence left on the computers that controlled them.
A Terror-Linked Gang Meets High-Tech Bank Crime
Federal prosecutors in Nebraska say those empty ATMs were not isolated bank losses. They describe them as the visible edge of a coordinated operation that combined a Venezuelan criminal group, specialized malware, and a network of recruits moving city to city across the United States.
According to a January 2026 report from Fox News, the U.S. Attorney’s Office for the District of Nebraska announced charges against 31 new defendants, bringing the total to 87 people indicted in what officials call a nationwide ATM jackpotting conspiracy linked to Tren de Aragua, or TdA. Prosecutors allege the group stole millions of dollars by forcing ATMs to spit out cash on command.
The new charges follow related federal indictments that officials say were unsealed in October and December of the previous year. Trials and full evidentiary hearings have not yet taken place, and the defendants are presumed innocent unless and until they are convicted in court.
Who Tren de Aragua Is, According to Investigators
Tren de Aragua emerged in Venezuela in the 2010s and has been linked by regional authorities and researchers to extortion, drug trafficking, and human smuggling across several Latin American countries. In U.S. court filings and public statements cited by Fox News, officials refer to TdA as a terrorist organization and say it has expanded operations into the United States.
The Nebraska case alleges that many of the 87 defendants are Venezuelan or Colombian nationals and that a number are TdA members or associates. Prosecutors say the proceeds from the ATM scheme did not stay in the banking system for long.
U.S. Attorney Lesley A. Woods for the District of Nebraska is quoted as saying that the ring used the stolen money to support human trafficking, child sex trafficking, kidnapping, murder, and, in Woods’s words, “other unspeakably evil and violent acts.”
Attorney General Pamela Bondi added in a public statement that “Tren de Aragua is a complex terrorist organization that commits serious financial crimes in addition to horrific rapes, murders, and drug trafficking.” She said the Justice Department “will continue working tirelessly to put these vicious terrorists behind bars.”
Those characterizations reflect the U.S. government’s allegations and public framing. A criminal trial would require prosecutors to tie specific defendants, not only to Tren de Aragua as a group, but also to particular criminal acts.
How ATM Jackpotting Works in This Case
“ATM jackpotting” is a term used in law enforcement and cybersecurity circles for attacks that force a cash machine to dispense large sums of money on command. The attacker usually bypasses normal withdrawal limits by compromising the ATM’s internal computer.
According to the Justice Department’s summary of the Nebraska indictments as reported by Fox News, the group allegedly relied on a malware family known as Ploutus to carry out these heists. Ploutus has been documented in earlier cases in Latin America as software that can be installed on an ATM to give attackers direct control over cash dispensing.
In this case, officials say the operation followed a general pattern:
Item 1: Scouts arrived at banks and credit unions to identify target ATMs and record visible security features, such as cameras or alarms.
Item 2: Teams allegedly opened the hood or door of a chosen machine, then waited to see whether any alarms triggered a response from law enforcement or private security.
Item 3: Once they believed it was safe, the attackers installed Ploutus using one of several methods, including swapping the existing hard drive for one preloaded with the malware, removing the hard drive to install software directly, or connecting an external device, such as a thumb drive, to infect the system.
Item 4: After installation, they are accused of using the malware to order the machine to eject large amounts of cash, sometimes repeatedly, before the bank could detect the issue and shut the ATM down.
Prosecutors say Ploutus was designed to delete evidence of its presence, which, if proven, would make post-incident forensic analysis difficult and complicate banks’ efforts to understand how much money had been taken and in how many incidents.
The Charges and What They Cover
Investigation into International “ATM Jackpotting” Scheme and Tren de Aragua results in Additional Indictment and 87 Total Charged Defendants
“Tren de Aragua is a complex terrorist organization that commits serious financial crimes in addition to horrific rapes, murders, and… pic.twitter.com/g15mbJ4pFw
— U.S. Department of Justice (@TheJusticeDept) January 26, 2026
The Nebraska indictment reportedly contains 32 counts. According to Fox News’s review of the charging documents, the counts include bank fraud, bank burglary, computer fraud, and damage to computers, among other offenses.
Across the whole group of 87 defendants from the October, December, and January actions, federal prosecutors say the charges range more broadly:
Item 1: Material support to a designated foreign terrorist organization.
Item 2: Bank burglary and bank fraud.
Item 3: Money laundering.
Item 4: Damage to and unauthorized access to protected computers.
Item 5: Conspiracy to commit each of those underlying offenses.
Those charges indicate two strands of criminal theory. One focuses on financial and computer crimes that directly affect banks, credit unions, and, potentially, their customers. The other focuses on the alleged relationship between those financial crimes and Tren de Aragua’s wider violent activity.
At this stage, the public record, as described by Fox News, does not include detailed loss figures for the affected financial institutions or a complete list of locations where ATMs were compromised. It also does not specify how much of the alleged theft prosecutors believe can be directly tied to Tren de Aragua leadership, versus local cells or opportunistic participants.
Security Gaps and Cross-Border Crime
Cases like this one do not exist in isolation. Cybersecurity researchers have been warning for more than a decade that ATMs, especially older models, can be vulnerable to malware that overrides regular withdrawal protocols, including iterations of Ploutus documented in Latin America.
The Nebraska indictments suggest that such techniques may now be fully integrated into the toolset of transnational criminal groups. If the government’s allegations are borne out in court, the case will provide one of the clearest examples of an organization associated with human trafficking and violent crime also investing in technically sophisticated financial fraud inside the U.S. banking system.
For banks and credit unions, the filings underscore the importance of basic physical security around ATMs, as well as controls that detect unusual withdrawal patterns and possible tampering at the operating system level. Law enforcement points to a challenge that is partly about local response times and partly about tracking people and money across borders.
What Remains Unanswered
Significant parts of the picture remain incomplete in the public record.
It is not yet clear how many of the 87 defendants are in custody, how many may still be outside the United States, or how high up the alleged conspiracy reaches within Tren de Aragua’s hierarchy. The available reporting also does not specify whether any cooperating witnesses have agreed to testify about the scheme’s internal structure.
Nor is it yet known how banks will handle reimbursement or fraud claims in relation to these alleged jackpotting incidents, or how much detail will eventually be disclosed about specific affected customers.
As cases move into pretrial motions and, eventually, trials or plea hearings, the indictments will have to translate into evidence linking individual defendants to specific acts at specific ATMs. Until that record is fully developed in court, the most detailed account of the scheme remains the government’s own description, and the question of how far responsibility extends within Tren de Aragua remains open.
