Five Venezuelan nationals pleaded guilty to attempting to empty automated teller machines (ATMs) using malware in a series of ATM jackpotting attacks.
27-year-old Luis Alberto Velasquez-Artigas, 29-year-oldRoyder Adrian Figuera-Perez, 27-year-old Javier Mejia, Jr, 33-year-old Gabriel Alexjandro Corales-Garcia, 33, and 26-year-old Italo Lizandro Corrales-Carrillo have all pleaded guilty to one count of conspiracy to commit bank larceny.
While Velasquez-Artigas has already been sentenced to nine months in prison, the other defendants are awaiting sentencing.
“Jackpotting bandits are sweeping the nation. This particular group’s strategy was to specifically target ATMs they thought were by design more vulnerable to malware,” said U.S. Attorney Ryan A. Kriegshauser. “Fortunately, there is technology to help thwart jackpotting. We at the U.S. Attorney’s Office encourage banks and other financial institutions to invest in these updates, and we’re happy to answer questions about how to do so.”
In recent years, criminals have used ATMii, ATMitch, GreenDispenser, Alice, RIPPER, Skimer, SUCEFUL, and Ploutus malware to steal cash in ATM jackpotting attacks. The criminals install malware on the ATM’s internal computer, which they can control using an attached USB keyboard or the built-in PIN pad, to issue commands to the internal cash dispenser and empty the money storage cassette.
The five defendants were arrested in December 2025, days after failing to install malware in ATM jackpotting attempts in Wamego and Manhattan, Kansas, that were recorded by surveillance cameras.
“The conspirators were unsuccessful in installing the malware on the ATM in Wamego, but their attempts at installing the malware triggered the alarm causing law enforcement to respond, and the culprits didn’t return to the site,” the Justice Department added in a Monday press release. “In Manhattan, the group was equally unsuccessful in getting the ATM to dispense money. Both attempted thefts were captured by surveillance cameras, and the perpetrators were arrested a few days later.”
The FBI warned in February that criminals stole over $20 million last year in a massive surge of ATM jackpotting incidents.
This warning came after a wave of arrests targeting members of the Tren de Aragua Venezuelan criminal organization, all linked to a massive ATM jackpotting scheme that deployed Ploutus malware to steal millions in cash from ATMs across the United States.
In total, the Justice Department has charged 87 Tren de Aragua members, who are facing maximum prison terms ranging from 20 to 335 years each.
In January, South Carolina federal prosecutors also announced that two Venezuelan nationals convicted of jackpotting attacks will be deported after serving their sentences.
Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply.
The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments.
