Five Venezuelan Nationals Plead Guilty in ATM Jackpot Malware Attacks

Five Venezuelan nationals have pleaded guilty to conspiracy to commit bank theft after attempting to use malware to empty automated teller machines (ATMs) in so-called ATM jackpot attacks.

Luis Alberto Velazquez-Artigas, 27; Royder Adrian Figuera-Perez, 29; Javier Mejia Jr., 27; Gabriel Alexandro Corrales-Garcia, 33; and Italo Lizandro Corrales-Carrillo, 26, each pleaded guilty to one count of conspiracy to commit bank theft.

Velazquez-Artigas has been sentenced to nine months in prison. The remaining defendants are awaiting sentencing.

“Jackpot robberies are rampant across the country. This particular group’s strategy was to specifically target ATMs, which by design are considered vulnerable to malware,” U.S. Attorney Ryan A. Kriegshauser said. “Fortunately, there are technologies available to help stop jackpots. We at the U.S. Attorney’s Office encourage banks and other financial institutions to invest in these updates, and we are happy to answer any questions about how to do so.”

Cybercriminals have used ATM malware such as ATMii, ATMitch, GreenDispenser, RIPPER, Skimer, Suceful, and Ploutus to carry out ATM jackpot attacks. After malware is installed on an ATM’s internal computer, criminals can use a USB keyboard or the machine’s built-in PIN pad to issue commands to the cash dispenser and empty its cash cassettes.

The five defendants were arrested in December 2025, days after allegedly attempting to install ATM malware in Wamego and Manhattan, Kansas. Surveillance cameras captured both incidents.

“Although the co-conspirators were unsuccessful in installing the malware on Wamego’s ATM, the attempted malware installation set off an alarm, law enforcement responded, and the perpetrators did not return to the scene,” the Justice Department said in a Monday press release. “In Manhattan, the group similarly failed to withdraw money from an ATM. Both attempted thefts were caught on surveillance camera, and the perpetrators were arrested several days later.”

The FBI warned in February that ATM jackpot attacks have surged, with criminals stealing more than $20 million during the previous year.

The warning followed a series of arrests involving members of the Venezuelan criminal organization Tren de Aragua. Investigators say members of the group participated in a large-scale ATM jackpot scheme that used Ploutus malware to steal millions of dollars from ATMs across the United States.

The Justice Department has indicted 87 alleged Tren de Aragua members in connection with the broader criminal activity. The defendants could face lengthy federal prison sentences if convicted.

In January, federal prosecutors in South Carolina also announced that two Venezuelan nationals convicted in ATM jackpot attacks would be deported after serving their prison sentences.

The overall prevention score can hide what happens after the initial access. If an attacker uses valid credentials, your defenses drop dramatically.

The Blue Report 2026 measures defense techniques by technology across 338 million simulations run in customer production environments.

Get the report