A Venezuelan bank robbery gang coordinated a conspiracy from Venezuela, Colombia, and Mexico to commit banking fraud, robbery, and cyber fraud against ATMs in the United States.
As a result, a formal indictment was filed in the District Court for Nebraska against a long list of defendants. The charges center around a series of jackpotting attacks carried out between January 2024 and August 2025, where the conspirators allegedly used the malware “Ploutus” to force ATMs from various banks and credit unions to dispense cash.
In the case of some defendants, the judge declared a complex case and adjusted the preparation deadlines for a fast-tracked trial, establishing a schedule to follow.
The Indictment
On August 19, 2025, an indictment was presented to the United States District Court for the District of Nebraska, detailing a large-scale international conspiracy in which 21 individuals are accused of defrauding numerous financial institutions in the United States.
The operation, which extended from January 1, 2024, to August 1, 2025, involved executing sophisticated cyberattacks known as jackpotting (illegal ATM interference) using a specific malware called “Ploutus.” The conspirators forced ATMs to dispense large amounts of cash without debiting any accounts.
The criminal network operated across multiple countries coordinating actions from various locations, including the District of Nebraska, Venezuela, Colombia, and Mexico. Physical ATM attacks were perpetrated in numerous U.S. states such as Nebraska, Utah, Kansas, Washington, Iowa, Oklahoma, Tennessee, Missouri, New York, Oregon, Colorado, and Michigan.
The charges presented include:
- Conspiracy to commit bank fraud,
- Conspiracy to commit bank robbery, and
- Computer fraud,
along with multiple individual charges for each attack.
The United States government is seeking the forfeiture of all property and profits derived from these illegal activities.
Conspiracy Profile
The conspiracy operated through a series of coordinated and defined steps:
- Development and acquisition of malware: members created or acquired the “Ploutus” malware by 2017.
- Recruitment: actively recruited co-conspirators to deploy malware on ATMs throughout the United States.
- Identification of targets: conspiracy leaders identified specific financial institutions as targets.
- Remote coordination: using encrypted messaging platforms like Telegram or WhatsApp, coordinators directed on-ground teams.
Logistical support was also provided, covering expenses like fuel and accommodation.
The indictment names the following 21 individuals as defendants in the conspiracy:
Alfredo Pinto-Mendoza, Juan Manuel Gouveia-Aguilera, Yoinber Alfonso Morey Morey, Cristhian Alexander Muñoz Pérez, Dyfred Jofiel Reyes-Palacios, Eyder Bueno Francia, Cristian Manuel Tovar-Olivares, Snaider Sthiferson Castro Hidalgo, José Antonio Aliendres García, Yohalex García-Valladares, Alexander José Mayora-Blanco, Johan Rodríguez-Hernández, Iván José Angulo Flores, José David Álvarez-Jiménez, María Ríos-Arévalo (also known as María R. Betania), Darwin Daniel Salinas-Victorra, Jóvito Brakwaitte-Blanco, Jesús Páez Avendaño, David Ramiro Fallo-Santonicola, Joel Alejandro Morantes Leal, Endis Daniel González Ortega.
The following federally insured institutions were identified as victims of the attacks or attempted attacks:
- Premier Bank
- Arbor Bank
- West Gate Bank
- Iowa State Savings Bank
- Oklahoma Heritage Bank
- McCook National Bank
- Adams County Bank
- Dundee Bank
- Adrian Bank
- Five Points Bank
- Baker Boyer Bank
- Cornhusker Bank
- Heritage Bank
- Columbus Bank & Trust
- Iowa Trust & Savings Bank
- Farmers and Merchants Bank
- Cornerstone Bank
- Heartland Bank
- Points West Bank
- Bank of the Sierra
NCUA-insured credit unions include:
- Mountain America Credit Union
- Heartland Credit Union
- Washington State Employees Credit Union
- 5 Star Community Credit Union
- AmeriCU Credit Union
- Foothills Federal Credit Union
- High Point Federal Credit Union
- First Source Federal Credit Union
- Blue Ox Credit Union
- North Platte Union Pacific Employee Community Credit Union
- Trius Federal Credit Union
- Merced School Employees Federal Credit Union
Manifest Acts and Attack Timeline
The indictment details numerous manifest acts committed to promote the conspiracy. The following table summarizes the specific documented attacks, including dates, locations, amounts, and the accused allegedly involved.
Date(s)Institution and LocationAccused InvolvedResult (Amount Obtained/Tried)
February 6, 2024 Mountain America Credit Union, Salt Lake City, UT Unknown in statement Obtained: USD 56,800
July 5-6, 2024 Heartland Credit Union, Hutchinson, KS Unknown in statement Obtained: USD 25,000
July 8, 2024 Heartland Credit Union, Hutchinson, KS Unknown in statement Obtained: USD 25,000
July 18 & 26, 2024 Washington State Employees CU, Olympia, WA Joel Alejandro Morantes Leal Obtained: USD 70,600
October 6, 2024 Arbor Bank, Nebraska City, NE Unknown in statement Obtained: USD 19,000
December 11, 2024 Iowa State Savings Bank, Creston, IA Cristhian Alexander Munoz Perez Obtained: USD 108,000
January 10, 2025 Oklahoma Heritage Bank, Ada, OK Ivan Jose Angulo Flores, Darwin Daniel Salinas-Victorra Obtained: USD 28,800
January 11, 2025 Oklahoma Heritage Bank, Roff, OK Ivan Jose Angulo Flores, Darwin Daniel Salinas-Victorra Obtained: USD 34,590
February 1, 2025 AmeriCU Credit Union, Rome, NY Unknown in statement Tried: USD 48,156
March 15, 2025 Foothills Federal Credit Union, Loudon, TN María Rios-Arevalo, Darwin Daniel Salinas-Victorra, Jóvito Brakwaitte-Blanco, David Ramiro Fallo-Santonicola Obtained: USD 66,000
March 27, 2025 High Point Federal Credit Union, Olean, NY Cristhian Alexander Munoz Perez Tried: USD 153,940
March 27-28, 2025 First Source Federal Credit Union, Rome, NY Cristhian Alexander Munoz Perez Tried: USD 117,347
March 27-28, 2025 First Source Federal Credit Union, New Hartford, NY Cristhian Alexander Munoz Perez Tried: USD 96,787
March 30, 2025 Dundee Bank, Omaha, NE Unknown in statement Obtained: USD 5,600
March 30, 2025 Dundee Bank, Omaha, NE Unknown in statement Obtained: USD 79,200
April 1, 2025 Dundee Bank, Omaha, NE Unknown in statement Obtained: USD 39,960
April 3, 2025 Adrian Bank, Butler, MO Ivan Jose Angulo Flores, José Antonio Aliendres García, Dyfred Jofiel Reyes-Palacios, Eyder Bueno Francia, Yoinber Alfonso Morey Morey Obtained: USD 50,000
April 3, 2025 Adrian Bank, Adrian, MO Ivan Jose Angulo Flores, José Antonio Aliendres García, Dyfred Jofiel Reyes-Palacios, Eyder Bueno Francia, Yoinber Alfonso Morey Morey Obtained: USD 3,800
April 4-5, 2025 Five Points Bank, Grand Island, NE Yoinber Alfonso Morey Morey Tried: USD 163,960
April 5-6, 2025 Baker Boyer Bank, Walla Walla, WA Juan Manuel Gouveia-Aguilera, Alfredo Pinto-Mendoza Obtained: USD 93,480
April 5-6, 2025 Baker Boyer Bank, Walla Walla, WA Juan Manuel Gouveia-Aguilera, Alfredo Pinto-Mendoza Obtained: USD 60,640
April 5-6, 2025 Baker Boyer Bank, Milton-Freewater, OR Juan Manuel Gouveia-Aguilera, Alfredo Pinto-Mendoza Obtained: USD 43,920
April 7, 2025 Arbor Bank, Hamburg, IA Yoinber Alfonso Morey Morey Tried: USD 20,000
April 8, 2025 Arbor Bank, Elkhorn, NE Yoinber Alfonso Morey Morey Tried: USD 20,000
April 8, 2025 West Gate Bank, Lincoln, NE Yoinber Alfonso Morey Morey Tried: USD 123,337
April 8, 2025 Cornhusker Bank, Lincoln, NE Yoinber Alfonso Morey Morey Tried: USD 48,500
April 9, 2025 Five Points Bank, Grand Island, NE Yoinber Alfonso Morey Morey Tried: USD 46,480
April 9, 2025 Heritage Bank, Grand Island, NE Yoinber Alfonso Morey Morey Tried: USD 13,410
April 13, 2025 Columbus Bank & Trust, Columbus, NE Unknown in statement Obtained: USD 20,800
April 13, 2025 Columbus Bank & Trust, Columbus, NE Unknown in statement Obtained: USD 50,400
April 13, 2025 Iowa Trust and Savings Bank, Moravia, IA Ivan Jose Angulo Flores, Eyder Bueno Francia, Dyfred Jofiel Reyes Palacios Obtained: USD 10,000
April 15, 2025 Blue Ox Credit Union, Sterling Heights, MI Eyder Bueno Francia, Dyfred Jofiel Reyes-Palacios Tried: USD 37,373
April 27, 2025 Points West Bank, Wellington, CO Juan Gouveia-Aguilera, Alfredo Pinto-Mendoza Obtained: USD 8,000
May 29, 2025 Points West Bank, Sidney, NE Joel Alejandro Morantes Leal, Endis Daniel Gonzalez Ortega Obtained: USD 32,000
May 29, 2025 Cornerstone Bank, Plattsmouth, NE Jesús Páez Avendaño Obtained: USD 54,000
July 6, 2025 Heartland Bank, Kearney, NE Snaider Sthiferson Castro Hidalgo, Cristian Manuel Tovar-Olivares Tried: USD 17,000
Federal Charges Filed
The formal indictment lays multiple federal charges against the 21 defendants, both collectively and individually.
Charge I: Conspiracy to Commit Bank Fraud (18 U.S.C. § 1349)
Accuses all involved of knowingly conspiring to execute a scheme to defraud financial institutions using the Ploutus malware and jackpotting attacks, in violation of Title 18, Section 1344 of the U.S. Code.
Charge II: Conspiracy to Commit Bank Robbery and Computer Fraud (18 U.S.C. § 371):
Accuses individuals of conspiring to commit crimes against the United States, specifically:
- Entering or attempting to enter a bank building with the intent to commit larceny (violation of 18 U.S.C. § 2113(a)).
- Knowingly accessing a protected computer with the intent to defraud without authorization to obtain something of value (violation of 18 U.S.C. § 1030(a)(4)).
- Knowingly causing the transmission of a malicious program or code, intentionally causing damage to a protected computer (violation of 18 U.S.C. § 1030(a)(5)).
Individual Charges (Charges III-LVI)
In addition to conspiracy charges, specific charges are filed against individuals or groups for specific acts committed in Nebraska and elsewhere. These charges include:
- Bank robbery (Charges XXI-XXXVIII): charges for entering specific banks intending to commit theft.
- Damage to protected computers (Charges III-XX and XXXIX-LVI): charges for intentionally transmitting malicious programs to damage the banks’ computer systems, resulting in losses over USD 5,000.
Forfeiture
In accordance with federal law, the formal indictment includes a notification of forfeiture.
If convicted, all defendants must hand over to the U.S. government any property that constitutes or derives from the profits obtained, directly or indirectly, as a result of their violations.
Various Legal Proceedings
Since then, on August 29, 2025, the court adopted a set of decisions ranging from issuing arrest orders for the defendants to appointing attorneys.
On September 18, 2025, Magistrate Judge Ryan C. Carson granted a motion to continue the trial regarding Alexander José Mayora Blanco. He established that pre-trial motions must be submitted by October 20, 2025. The time elapsed from the indicated date until October 20, 2025, would be excluded from any time computation as provided by the Speedy Trial Act.
On the same date, a motion for extension was granted for José Antonio Aliendres García, ordering that pre-trial motions be submitted by October 1, 2025. Additionally, the time elapsed from the decision until October 1, 2025, would be excluded from any time computation as stipulated by the Speedy Trial Act.
Also on September 18, 2025, the government was granted until October 1, 2025, to file its opposition brief to José Antonio Aliendres García’s Motion for Exclusion.
Speedy Trial Timeline
On September 25, 2025, Judge Carson, in the case of the defendants: Cristhian Alexander Muñoz Pérez, Eduar Jesús Páez Avendaño, Joel Alejandro Morantes Leal, and Endis Daniel González Ortega, addressed a request from the government, agreed upon by the defendants, to declare the case as “complex” and adjust the preparation timelines.
The court determined that the unusual nature and complexity of the case, including novel factual and legal issues along with the volume of discovery, make it unreasonable to comply with the Speedy Trial Act.
Therefore, it ordered:
- The government will provide Rule 16 discovery by November 3, 2025, at the latest.
- The deadline for pre-trial motions is set for December 3, 2025.
- The additional time granted until December 3, 2025, is considered excluded time under the Speedy Trial Act since the ends of justice outweigh the interest in a speedy trial.