Skip to content
Home » Venezuelan Bank Robbers Orchestrated Massive ATM Fraud Scheme Across the Americas and the United States

Venezuelan Bank Robbers Orchestrated Massive ATM Fraud Scheme Across the Americas and the United States

A Venezuelan bank robbery gang coordinated a conspiracy from Venezuela, Colombia, and Mexico to commit banking fraud, robbery, and cyber fraud against ATMs in the United States.

As a result, a formal indictment was filed in the District Court for Nebraska against a long list of defendants. The charges center around a series of jackpotting attacks carried out between January 2024 and August 2025, where the conspirators allegedly used the malware “Ploutus” to force ATMs from various banks and credit unions to dispense cash.

In the case of some defendants, the judge declared a complex case and adjusted the preparation deadlines for a fast-tracked trial, establishing a schedule to follow.

The Indictment

On August 19, 2025, an indictment was presented to the United States District Court for the District of Nebraska, detailing a large-scale international conspiracy in which 21 individuals are accused of defrauding numerous financial institutions in the United States.

The operation, which extended from January 1, 2024, to August 1, 2025, involved executing sophisticated cyberattacks known as jackpotting (illegal ATM interference) using a specific malware called “Ploutus.” The conspirators forced ATMs to dispense large amounts of cash without debiting any accounts.

The criminal network operated across multiple countries coordinating actions from various locations, including the District of Nebraska, Venezuela, Colombia, and Mexico. Physical ATM attacks were perpetrated in numerous U.S. states such as Nebraska, Utah, Kansas, Washington, Iowa, Oklahoma, Tennessee, Missouri, New York, Oregon, Colorado, and Michigan.

The charges presented include:

  • Conspiracy to commit bank fraud,
  • Conspiracy to commit bank robbery, and
  • Computer fraud,

along with multiple individual charges for each attack.

The United States government is seeking the forfeiture of all property and profits derived from these illegal activities.

Conspiracy Profile

The conspiracy operated through a series of coordinated and defined steps:

  • Development and acquisition of malware: members created or acquired the “Ploutus” malware by 2017.
  • Recruitment: actively recruited co-conspirators to deploy malware on ATMs throughout the United States.
  • Identification of targets: conspiracy leaders identified specific financial institutions as targets.
  • Remote coordination: using encrypted messaging platforms like Telegram or WhatsApp, coordinators directed on-ground teams.

Logistical support was also provided, covering expenses like fuel and accommodation.

The indictment names the following 21 individuals as defendants in the conspiracy:

Alfredo Pinto-Mendoza, Juan Manuel Gouveia-Aguilera, Yoinber Alfonso Morey Morey, Cristhian Alexander Muñoz Pérez, Dyfred Jofiel Reyes-Palacios, Eyder Bueno Francia, Cristian Manuel Tovar-Olivares, Snaider Sthiferson Castro Hidalgo, José Antonio Aliendres García, Yohalex García-Valladares, Alexander José Mayora-Blanco, Johan Rodríguez-Hernández, Iván José Angulo Flores, José David Álvarez-Jiménez, María Ríos-Arévalo (also known as María R. Betania), Darwin Daniel Salinas-Victorra, Jóvito Brakwaitte-Blanco, Jesús Páez Avendaño, David Ramiro Fallo-Santonicola, Joel Alejandro Morantes Leal, Endis Daniel González Ortega.

The following federally insured institutions were identified as victims of the attacks or attempted attacks:

  • Premier Bank
  • Arbor Bank
  • West Gate Bank
  • Iowa State Savings Bank
  • Oklahoma Heritage Bank
  • McCook National Bank
  • Adams County Bank
  • Dundee Bank
  • Adrian Bank
  • Five Points Bank
  • Baker Boyer Bank
  • Cornhusker Bank
  • Heritage Bank
  • Columbus Bank & Trust
  • Iowa Trust & Savings Bank
  • Farmers and Merchants Bank
  • Cornerstone Bank
  • Heartland Bank
  • Points West Bank
  • Bank of the Sierra

NCUA-insured credit unions include:

  • Mountain America Credit Union
  • Heartland Credit Union
  • Washington State Employees Credit Union
  • 5 Star Community Credit Union
  • AmeriCU Credit Union
  • Foothills Federal Credit Union
  • High Point Federal Credit Union
  • First Source Federal Credit Union
  • Blue Ox Credit Union
  • North Platte Union Pacific Employee Community Credit Union
  • Trius Federal Credit Union
  • Merced School Employees Federal Credit Union

Manifest Acts and Attack Timeline

The indictment details numerous manifest acts committed to promote the conspiracy. The following table summarizes the specific documented attacks, including dates, locations, amounts, and the accused allegedly involved.

Date(s)Institution and LocationAccused InvolvedResult (Amount Obtained/Tried)

February 6, 2024 Mountain America Credit Union, Salt Lake City, UT Unknown in statement Obtained: USD 56,800

July 5-6, 2024 Heartland Credit Union, Hutchinson, KS Unknown in statement Obtained: USD 25,000

July 8, 2024 Heartland Credit Union, Hutchinson, KS Unknown in statement Obtained: USD 25,000

July 18 & 26, 2024 Washington State Employees CU, Olympia, WA Joel Alejandro Morantes Leal Obtained: USD 70,600

October 6, 2024 Arbor Bank, Nebraska City, NE Unknown in statement Obtained: USD 19,000

December 11, 2024 Iowa State Savings Bank, Creston, IA Cristhian Alexander Munoz Perez Obtained: USD 108,000

January 10, 2025 Oklahoma Heritage Bank, Ada, OK Ivan Jose Angulo Flores, Darwin Daniel Salinas-Victorra Obtained: USD 28,800

January 11, 2025 Oklahoma Heritage Bank, Roff, OK Ivan Jose Angulo Flores, Darwin Daniel Salinas-Victorra Obtained: USD 34,590

February 1, 2025 AmeriCU Credit Union, Rome, NY Unknown in statement Tried: USD 48,156

March 15, 2025 Foothills Federal Credit Union, Loudon, TN María Rios-Arevalo, Darwin Daniel Salinas-Victorra, Jóvito Brakwaitte-Blanco, David Ramiro Fallo-Santonicola Obtained: USD 66,000

March 27, 2025 High Point Federal Credit Union, Olean, NY Cristhian Alexander Munoz Perez Tried: USD 153,940

March 27-28, 2025 First Source Federal Credit Union, Rome, NY Cristhian Alexander Munoz Perez Tried: USD 117,347

March 27-28, 2025 First Source Federal Credit Union, New Hartford, NY Cristhian Alexander Munoz Perez Tried: USD 96,787

March 30, 2025 Dundee Bank, Omaha, NE Unknown in statement Obtained: USD 5,600

March 30, 2025 Dundee Bank, Omaha, NE Unknown in statement Obtained: USD 79,200

April 1, 2025 Dundee Bank, Omaha, NE Unknown in statement Obtained: USD 39,960

April 3, 2025 Adrian Bank, Butler, MO Ivan Jose Angulo Flores, José Antonio Aliendres García, Dyfred Jofiel Reyes-Palacios, Eyder Bueno Francia, Yoinber Alfonso Morey Morey Obtained: USD 50,000

April 3, 2025 Adrian Bank, Adrian, MO Ivan Jose Angulo Flores, José Antonio Aliendres García, Dyfred Jofiel Reyes-Palacios, Eyder Bueno Francia, Yoinber Alfonso Morey Morey Obtained: USD 3,800

April 4-5, 2025 Five Points Bank, Grand Island, NE Yoinber Alfonso Morey Morey Tried: USD 163,960

April 5-6, 2025 Baker Boyer Bank, Walla Walla, WA Juan Manuel Gouveia-Aguilera, Alfredo Pinto-Mendoza Obtained: USD 93,480

April 5-6, 2025 Baker Boyer Bank, Walla Walla, WA Juan Manuel Gouveia-Aguilera, Alfredo Pinto-Mendoza Obtained: USD 60,640

April 5-6, 2025 Baker Boyer Bank, Milton-Freewater, OR Juan Manuel Gouveia-Aguilera, Alfredo Pinto-Mendoza Obtained: USD 43,920

April 7, 2025 Arbor Bank, Hamburg, IA Yoinber Alfonso Morey Morey Tried: USD 20,000

April 8, 2025 Arbor Bank, Elkhorn, NE Yoinber Alfonso Morey Morey Tried: USD 20,000

April 8, 2025 West Gate Bank, Lincoln, NE Yoinber Alfonso Morey Morey Tried: USD 123,337

April 8, 2025 Cornhusker Bank, Lincoln, NE Yoinber Alfonso Morey Morey Tried: USD 48,500

April 9, 2025 Five Points Bank, Grand Island, NE Yoinber Alfonso Morey Morey Tried: USD 46,480

April 9, 2025 Heritage Bank, Grand Island, NE Yoinber Alfonso Morey Morey Tried: USD 13,410

April 13, 2025 Columbus Bank & Trust, Columbus, NE Unknown in statement Obtained: USD 20,800

April 13, 2025 Columbus Bank & Trust, Columbus, NE Unknown in statement Obtained: USD 50,400

April 13, 2025 Iowa Trust and Savings Bank, Moravia, IA Ivan Jose Angulo Flores, Eyder Bueno Francia, Dyfred Jofiel Reyes Palacios Obtained: USD 10,000

April 15, 2025 Blue Ox Credit Union, Sterling Heights, MI Eyder Bueno Francia, Dyfred Jofiel Reyes-Palacios Tried: USD 37,373

April 27, 2025 Points West Bank, Wellington, CO Juan Gouveia-Aguilera, Alfredo Pinto-Mendoza Obtained: USD 8,000

May 29, 2025 Points West Bank, Sidney, NE Joel Alejandro Morantes Leal, Endis Daniel Gonzalez Ortega Obtained: USD 32,000

May 29, 2025 Cornerstone Bank, Plattsmouth, NE Jesús Páez Avendaño Obtained: USD 54,000

July 6, 2025 Heartland Bank, Kearney, NE Snaider Sthiferson Castro Hidalgo, Cristian Manuel Tovar-Olivares Tried: USD 17,000

Federal Charges Filed

The formal indictment lays multiple federal charges against the 21 defendants, both collectively and individually.

Charge I: Conspiracy to Commit Bank Fraud (18 U.S.C. § 1349)

Accuses all involved of knowingly conspiring to execute a scheme to defraud financial institutions using the Ploutus malware and jackpotting attacks, in violation of Title 18, Section 1344 of the U.S. Code.

Charge II: Conspiracy to Commit Bank Robbery and Computer Fraud (18 U.S.C. § 371):

Accuses individuals of conspiring to commit crimes against the United States, specifically:

  • Entering or attempting to enter a bank building with the intent to commit larceny (violation of 18 U.S.C. § 2113(a)).
  • Knowingly accessing a protected computer with the intent to defraud without authorization to obtain something of value (violation of 18 U.S.C. § 1030(a)(4)).
  • Knowingly causing the transmission of a malicious program or code, intentionally causing damage to a protected computer (violation of 18 U.S.C. § 1030(a)(5)).

Individual Charges (Charges III-LVI)

In addition to conspiracy charges, specific charges are filed against individuals or groups for specific acts committed in Nebraska and elsewhere. These charges include:

  • Bank robbery (Charges XXI-XXXVIII): charges for entering specific banks intending to commit theft.
  • Damage to protected computers (Charges III-XX and XXXIX-LVI): charges for intentionally transmitting malicious programs to damage the banks’ computer systems, resulting in losses over USD 5,000.

Forfeiture

In accordance with federal law, the formal indictment includes a notification of forfeiture.

If convicted, all defendants must hand over to the U.S. government any property that constitutes or derives from the profits obtained, directly or indirectly, as a result of their violations.

Various Legal Proceedings

Since then, on August 29, 2025, the court adopted a set of decisions ranging from issuing arrest orders for the defendants to appointing attorneys.

On September 18, 2025, Magistrate Judge Ryan C. Carson granted a motion to continue the trial regarding Alexander José Mayora Blanco. He established that pre-trial motions must be submitted by October 20, 2025. The time elapsed from the indicated date until October 20, 2025, would be excluded from any time computation as provided by the Speedy Trial Act.

On the same date, a motion for extension was granted for José Antonio Aliendres García, ordering that pre-trial motions be submitted by October 1, 2025. Additionally, the time elapsed from the decision until October 1, 2025, would be excluded from any time computation as stipulated by the Speedy Trial Act.

Also on September 18, 2025, the government was granted until October 1, 2025, to file its opposition brief to José Antonio Aliendres García’s Motion for Exclusion.

Speedy Trial Timeline

On September 25, 2025, Judge Carson, in the case of the defendants: Cristhian Alexander Muñoz Pérez, Eduar Jesús Páez Avendaño, Joel Alejandro Morantes Leal, and Endis Daniel González Ortega, addressed a request from the government, agreed upon by the defendants, to declare the case as “complex” and adjust the preparation timelines.

The court determined that the unusual nature and complexity of the case, including novel factual and legal issues along with the volume of discovery, make it unreasonable to comply with the Speedy Trial Act.

Therefore, it ordered:

  • The government will provide Rule 16 discovery by November 3, 2025, at the latest.
  • The deadline for pre-trial motions is set for December 3, 2025.
  • The additional time granted until December 3, 2025, is considered excluded time under the Speedy Trial Act since the ends of justice outweigh the interest in a speedy trial.