The federal justice system in the United States has taken a significant stride in the fight against transnational organized crime by exposing one of the vastest and most sophisticated financial conspiracies ever attributed to a Venezuelan criminal organization. A federal grand jury in the District of Nebraska has charged 54 individuals for their alleged involvement in a massive “ATM jackpotting” scheme, a type of cyber attack that allowed the theft of millions of dollars from ATMs across the country. The indictment claims that the proceeds funded terrorist activities of the Tren de Aragua (TdA).
The charges are divided into two major criminal cases. The first, returned on December 9, 2025, accuses 22 individuals of crimes ranging from conspiracy to provide material support to a terrorist organization, to bank fraud, robbery of financial institutions, computer crimes, and money laundering. The second, dated October 21, 2025, involves another 32 defendants, accumulating 56 charges, including multiple counts of bank fraud, bank robbery, and damage to protected computer systems. If found guilty, some defendants could face sentences totaling up to 335 years in prison.
At the center of the indictment is Tren de Aragua, characterized by U.S. authorities not just as a criminal gang, but as a violent terrorist organization with hemispheric reach. Emerging as a prison gang in Venezuela in the mid-2000s, TdA is said to have evolved into a transnational network involved in drug trafficking, arms trafficking, human trafficking, kidnapping, extortion, and homicides, now adding high-tech financial crime as a new and lucrative source of revenue.
One name drawing significant attention in the indictment is Jimena Romina Araya Navarro, identified as a leader of Tren de Aragua and a well-known figure in the Venezuelan entertainment scene. Araya Navarro, previously sanctioned by the Office of Foreign Assets Control (OFAC), was charged with providing material support to TdA in direct connection with the jackpotting scheme that affected numerous ATMs in Nebraska and other states. According to OFAC, Araya Navarro allegedly assisted in 2012 in facilitating the escape of Héctor Rusthenford Guerrero Flores, alias “Niño Guerrero”, the highest leader of Tren de Aragua, from the Tocorón prison in Venezuela. Public photographs show her socializing at events alongside Niño Guerrero, which prosecutors argue reinforces her role within the criminal structure.
The accusations detail the technical workings of the scheme. The conspiracy developed and deployed a variant of the malware Ploutus, designed to take control of ATM cash dispensing modules. Operational teams traveled in groups, conducting reconnaissance, assessing security measures, and, once police response was confirmed absent, opened the ATMs to install the malware. In some cases, they replaced entire hard drives; in others, they connected external devices like USB drives to execute the attack. The software not only forced the delivery of cash but was also programmed to erase traces and deceive detection systems, complicating the identification of the sabotage.
Authorities assert that the funds obtained were distributed according to pre-established quotas and subsequently transferred among members and associates to conceal their illicit origin. Part of the money, as stated in the indictment, ended up in the hands of leaders of Tren de Aragua to sustain criminal operations and acts of violence. Among those accused is also Aníbal Alexander Canelón Aguirre, alias “Prometheus,” identified as the alleged engineer behind the malware, currently believed to be located in Venezuela and charged with providing material support to TdA.
The nationwide reach of the scheme is reflected in maps and loss records that, up until August 2025, document attacks on ATMs across multiple states in the Union. For the Department of Justice, this case demonstrates how foreign criminal organizations have managed to merge traditional crime with advanced cyber capabilities, transforming digital attacks into a direct threat to the economic and national security of the United States.
“The message is clear: it doesn’t matter the cartel, the scale, or the location,” stated Tysen Duva, a high-ranking official in the Criminal Division of the Department of Justice. Similarly, federal prosecutor for the District of Nebraska, Lesley A. Woods, emphasized that the investigation was able to trace the money “from ATMs in the heart of the United States back to its terrorist roots in Venezuela,” highlighting the coordination among federal, state, and local agencies.
The FBI and Homeland Security Investigations both agreed to describe Tren de Aragua as a direct threat to U.S. communities, capable of rapidly adapting to new criminal opportunities. For authorities, the sophistication of the jackpotting scheme confirms that TdA does not operate as a makeshift gang but as a structured criminal enterprise, with technical specialists, logistical networks, and transnational command.
This operation is part of the Homeland Security Task Force (HSTF), established under Executive Order 14159, which promotes a “whole of government” approach against cartels, foreign gangs, and transnational criminal organizations. In this case, in addition to the FBI and HSI, multiple federal prosecutors, the Joint Task Force Vulcan—originally created to combat MS-13 and now expanded against Tren de Aragua—and offices of the Department of Justice both inside and outside the United States participated.
Although the accused enjoy the presumption of innocence until proven guilty at trial, the case sets a significant precedent: for the first time, a large-scale cyber financial crime is formally presented by U.S. authorities as a mechanism for financing transnational terrorism. For Tren de Aragua, and for other organizations watching how this process unfolds, the message is clear: the judicial system of the United States has chosen to pursue not just visible violence, but also the digital architectures supporting it from the shadows.