A federal grand jury in Nebraska has charged 31 additional people in a sweeping ATM hacking conspiracy that authorities say used malware to force machines to dispense cash, bringing the total number of defendants to 87, according to the U.S. Department of Justice.
Prosecutors allege the conspiracy was carried out by members and associates of Tren de Aragua, or TdA, which the government describes as a foreign terrorist organization that has expanded into the United States.
Many of those charged are Venezuelan and Colombian nationals, authorities said.
The latest indictment includes 32 counts, including conspiracy to commit bank fraud, conspiracy to commit bank burglary and computer fraud, bank fraud, bank burglary and damage to computers.
According to court documents, the group relied on a variant of malware known as Ploutus to gain control of ATMs.
Investigators say teams traveled nationwide, often using multiple vehicles, to target banks and credit unions.
They conducted surveillance of ATM locations, checked for security features and watched for alarms or law enforcement responses before installing the malware.
Prosecutors said the malware was installed in several ways, including removing or replacing ATM hard drives or connecting external devices such as thumb drives.
Once installed, Ploutus issued unauthorized commands to the machine’s cash-dispensing system, forcing withdrawals of currency.
The malware was also designed to delete evidence of the intrusion to hide the attack from banks and investigators, authorities said.
Proceeds were then divided among participants based on predetermined shares.
“This latest indictment demonstrates the Criminal Division’s commitment to dismantling cartels, including when they attack our nation’s financial systems with sophisticated malware,” said Assistant Attorney General A. Tysen Duva of the Justice Department’s Criminal Division.
Federal officials say the alleged scheme helps explain a series of ATM attacks reported around the country, including an incident in southeast Washington.
In April 2025, three ATMs operated by Baker Boyer Bank — two in Walla Walla and one in Milton-Freewater — were vandalized and money was stolen, according to bank officials and police.
The machines were taken out of service while authorities investigated what police described as a “sophisticated” break-in.
Walla Walla police initially responded to the report before turning the case over to the Federal Bureau of Investigation.
“Over that weekend, unknown suspects used sophisticated means to break in to and obtain money from three ATM machines at Walla Walla and Milton-Freewater branches,” Walla Walla police spokesperson Nick Loudermilk said at the time.
Federal prosecutors have not publicly linked the Baker Boyer case to the Nebraska indictments, and no charges have been announced in the Washington incidents.
Authorities have said similar jackpotting attacks were carried out nationwide as part of the broader conspiracy.
The new indictment follows earlier federal cases returned in October and December 2025 that charged dozens of defendants with bank fraud, bank burglary, computer crimes, money laundering and providing material support to a designated foreign terrorist organization.
Prosecutors allege the combined schemes generated millions of dollars in illegal proceeds.
If convicted, defendants in the cases face maximum prison sentences ranging from 20 years to as much as 335 years.
Investigators say Tren de Aragua began as a prison gang in Venezuela in the mid-2000s and has since grown into a transnational criminal organization involved in drug trafficking, firearms trafficking, sex trafficking, kidnapping, robbery, fraud and violent crime, along with large-scale financial crimes targeting U.S. banks and ATMs.
©2026 Cox Media Group
