This Gang Installed Malware on ATMs That Got Them to Spit Out All Their Cash

A Venezuelan gang used malware to infect ATMs across the US in an effort to steal millions.

The Justice Department provided details on the ATM thefts as part of a crackdown on the organized crime group Tren de Aragua.

“As alleged, these defendants employed methodical surveillance and burglary techniques to install malware into ATM machines, and then steal and launder money from the machines,” says Acting Assistant Attorney General Matthew Galeotti.

A federal grand jury in the District of Nebraska returned two indictments against 54 suspects, at least some of whom were recruited into the conspiracy. According to federal investigators, the gang used Ploutus, a malware that’s been around for over a decade. The program can hijack an ATM and dispense all the cash stored inside, a process known as “ATM jackpotting.”

DOJ surveilance

(Credit: DOJ)

The key hurdle is finding a way to install Ploutus, which can be achieved through a USB connection or by modifying the ATM machine’s hard drive. According to federal investigators, the suspects traveled in groups and scoped out ATMs at banks and credit unions.

“Following this reconnaissance, the groups would open the hood or door of ATMs and then wait nearby to see whether they had triggered an alarm or a law enforcement response,” the Justice Department said. “The groups would then take steps to install malware on the ATMs, by removing the hard drive and installing the malware directly, by replacing the hard drive with one that had been pre-loaded with the Ploutus malware, or by connecting an external device such as a thumb drive that would deploy the malware.”

The malware was configured to delete all evidence of the tampering once the cash had been dispensed. However, federal investigators were able to grab surveillance footage of at least some of the thefts, which show the suspect targeted ATM drive-thrus. Nevertheless, the scheme was able to drain “many millions of dollars,” according to US Attorney Lesley Woods.

Recommended by Our Editors

Hacker Combines Porn and Fake Windows Update Screen for Malware Attack

Buying DDR5 Memory? Watch Out for This Scam

Anthropic Warns of Hacker Weaponizing Claude AI Like Never Before

“If convicted, the defendants face a maximum term of imprisonment ranging between 20 and 335 years,” the department added.

The announcement only names one of the indicted suspects, Venezuelan model Jimena Romina Araya Navarro, who allegedly operates as a leader of Tren de Aragua. Earlier this month, the Treasury Department also sanctioned Araya Navarro for her alleged role in the group, which the US has designated as a terrorist organization.

In 2025, the District of Nebraska has charged 67 Tren de Aragua members and leaders on a range of charges, the DOJ says.

2025 worst year on record for global cyber breaches

Concerns persist over self-reported cyber readiness as DoD overhauls workforce management

Weld County, Colo., Alerts Are Back Online After Cyber Attack

Hundreds of Cisco customers are vulnerable to new Chinese hacking campaign, researchers say

Iranian APT Prince of Persia returns with new malware and C2 infrastructure