A total of 31 members of the Tren de Aragua were indicted by a federal grand jury in the District of Nebraska for allegedly being involved in a large conspiracy to attack through the installation of malware and steal millions of dollars from ATMs in the United States, a criminal method known as jackpotting.
Additionally, 56 other individuals were charged, with many being Venezuelans and Colombians living illegally in the U.S., following an investigation led by the National Security Task Force.
The charges against these Tren de Aragua members include 32 counts, such as:
- Conspiracy to commit bank fraud,
- Conspiracy to commit bank robbery and computer fraud,
- Bank fraud,
- Bank robbery, and
- Damage to computers.
Over 290 Tren de Aragua Members Processed
U.S. Attorney General Pamela Bondi stated that the “Tren de Aragua is a complex terrorist organization committing serious financial crimes, as well as atrocious violations, murders, and drug trafficking,” noting that the Department of Justice has already prosecuted over 290 of its members.
Bondi indicated that her office will continue working to imprison these “ruthless terrorists,” after the Joe Biden administration allegedly allowed them to infiltrate the U.S.
Meanwhile, Deputy Attorney General Todd Blanche reported that a large network of foreign criminals was allegedly part of a conspiracy throughout the United States, aiming to enrich themselves, both individually and as the Tren de Aragua terrorist organization, through fraud against American citizens.
Blanche added that after robbing banks, committing fraud, and other severe crimes, these individuals will face justice and be held accountable for their crimes, assuring that the Joint Task Force Vulcan of the Department of Justice will not cease its work until the Tren de Aragua and other foreign terrorists causing chaos in the U.S. are completely dismantled and destroyed.
The Indictment
Moreover, Deputy Attorney General A. Tysen Duva from the Criminal Division of the Department of Justice stated that this latest formal indictment demonstrates the agency’s commitment to dismantling the cartels, “even as they attack our nation’s financial systems with sophisticated malware.”
A total of 87 defendants are facing charges, reflecting the magnitude of these alleged conspiracies, which are being confronted with equal force and skill, the prosecutor asserted.
The malware or jackpotting attacks on ATMs carried out by Tren de Aragua across the United States serve as a funding mechanism for the organization, responsible for atrocious crimes such as human trafficking—including the sexual trafficking of minors in Nebraska—kidnappings, murders, and other “indescribably evil and violent acts,” said federal prosecutor for the District of Nebraska, Lesley A. Woods.
“The Federal Prosecutor’s Office for the District of Nebraska will fight directly against TDA taking all possible measures to block its financial flow and limit its capacity to terrorize American communities,” Woods added.
Chris Eason, co-director of the Joint Task Force Vulcan (JTFV), mentioned that Tren de Aragua transitioned from a prison gang to a transnational criminal organization, and finally to a foreign terrorist organization.
“The use of sophisticated malware to empty ATMs and harm U.S. financial institutions that also fund Tren de Aragua’s terrorist activities will not be tolerated.”
The Jackpotting Operation
FBI agents and analysts in Omaha, Nebraska, along with local, state, and federal officials, dismantled this international criminal conspiracy aimed at financing the foreign terrorist organization, Tren de Aragua.
Eugene Kowel from the FBI Omaha Field Office explained that Tren de Aragua employs a wide variety of sophisticated criminal tactics, posing a direct threat to communities across the U.S.
The case highlights the TDA’s plot to implement malware and steal large sums from financial institutions across the United States, as the FBI will continue tracking the money and allocating resources to arrest and apprehend Tren de Aragua members and leaders.
It was revealed that the alleged TDA conspiracy developed and implemented a malware variant known as Ploutus, which was used to hack ATMs and force them to dispense cash.
The TDA recruited several individuals to implement the Ploutus malware nationwide, traveling in groups in various vehicles to the target bank and credit union locations.
Initially, they conducted preliminary reconnaissance and noted the external security measures of the ATMs. Then, they opened the ATMs and waited nearby to check whether alarms were activated or if law enforcement might intervene.
Subsequently, Tren de Aragua members installed malware on the ATMs, extracted the hard drive, and replaced it with one preloaded with Ploutus malware or connected an external device, like a USB stick, to install it.
The Ploutus malware aims to issue unauthorized commands associated with the ATM’s cash dispensing module to force the withdrawal of money. This malware also removes evidence of its presence to create a false impression and deceive bank and credit union employees into not noticing its installation on the ATM.
Profit Sharing Plan
Members of Tren de Aragua involved in this conspiracy shared the profits in predetermined portions.
On December 9, 2025, a prior indictment was presented alleging that the designated Foreign Terrorist Organization Tren de Aragua carried out jackpotting attacks throughout the United States, with 22 individuals charged on that date for their involvement in the conspiracy:
- 13 individuals are charged with conspiracy to provide material support to terrorists,
- 10 with conspiracy to commit bank fraud,
- 10 with conspiracy to commit robbery, fraud, and computer-related activities, and
- 22 with conspiracy to launder money.
The indictment states that the TDA used jackpotting to steal millions of dollars in the United States, subsequently transferring profits among its members and associates to conceal the illegally obtained money.
A formal indictment dated October 21, 2025, charged 32 individuals with 56 counts, including conspiracy to commit bank fraud, conspiracy to commit bank robbery and computer fraud, 18 counts of bank fraud, 18 counts of bank robbery, and 18 counts of damage to computers.
It is estimated that if found guilty, the defendants could face sentences ranging from 20 to 335 years.