A Venezuelan group used malware to infect ATMs across the United States in an attempt to steal millions.
The Department of Justice provided details about the ATM thefts as part of a crackdown on organized crime group Tren de Aragua.
Acting Assistant Attorney General Matthew Gallotti says, “As alleged, these defendants used procedural surveillance and stealth techniques to install malware into ATM machines, and then steal and launder money from the machines.”
A federal grand jury in the District of Nebraska returned two indictments against 54 suspects, at least some of whom were recruited into the conspiracy. According to federal investigators, the group used Plutus, a piece of malware that has been around for more than a decade. This program can hijack an ATM and drain all the cash inside, a process known as “ATM jackpoting”.
(Credit: DOJ)
The key hurdle is finding a way to install the plots, which can be achieved through a USB connection or by modifying the ATM machine’s hard drive. According to federal investigators, the suspects traveled in groups and opened ATMs at banks and credit unions.
“After this echo, the groups would open the ATM’s hood or door and then wait nearby to see if they triggered an alarm or a law enforcement response,” the Justice Department said. “The group would then take steps to install malware on the ATM, either by removing the hard drive and installing the malware directly, replacing the hard drive with platters preloaded with malware, or attaching an external device such as a thumb drive that would deploy the malware.”
The malware was designed to delete all evidence of tampering once the cash was sent. However, federal investigators were able to obtain surveillance footage of at least some of the thefts, showing the suspect targeting ATM drive thrus. Even so, the scheme managed to net “several millions of dollars,” according to U.S. Attorney Leslie Woods.
Recommended by our editors
“If convicted, the defendants face a maximum prison term of between 20 and 335 years,” the department added.
The announcement only names one of the suspects, Venezuelan model Gemina Romina Araya Navarro, who allegedly acts as the leader of the Train de Aragua. Earlier this month, the Treasury Department also sanctioned Araya Navarro for his alleged role in the group, which the United States has designated as a terrorist organization.
In 2025, the District of Nebraska filed multiple charges against 67 Tren de Aragua members and leaders, the DOJ says.
Get our best stories!
Stay safe with the latest security news and updates
By clicking Sign Up, you confirm that you are 16+ years of age and agree to our Terms of Use and Privacy Policy.
Thanks for signing up!
Your membership has been confirmed. Watch your inbox!
About our expert
Michael Kahn
Senior reporter
Experience
I have been a journalist for over 15 years. I got my start as a schools and cities reporter in Kansas City and joined PCMag in 2017, where I cover satellite Internet services, cybersecurity, PC hardware and more. I am currently based in San Francisco, but previously spent over five years in China, covering the country’s technology sector.
Since 2020, I’ve covered the launch and explosive growth of SpaceX’s StarLink satellite Internet service, writing 600+ stories on availability and feature launches, but also regulatory battles over expanding satellite constellations, battles with rival providers like AST SpaceMobile and Amazon, and efforts to expand satellite-based mobile service. I’ve combed through FCC filings for the latest news and reached out to remote corners of California to test StarLink’s cellular service.
I also cover cyber threats, from ransomware gangs to the emergence of AI-based malware. Earlier this year, the FTC forced Avast to pay $16.5 million for secretly harvesting and selling its personal information to third-party clients, as revealed in my joint Investigation Along with the motherboard
I also cover the PC graphics card market. Pandemic-era shortages led me to camp out in front of a Best Buy to get an RTX 3000. Now I’m following how President Trump’s tariffs will affect the industry. I’m always eager to learn more, so please jump into the comments with feedback and send me pointers.
Read full bio
