Federal prosecutors say the Biden‑era border crisis produced one of the most brazen cybercrime cases in years. The Department of Justice charged 54 alleged members of the Venezuelan terror gang Tren de Aragua with using sophisticated malware to loot millions from U.S. ATMs and funnel the cash back to their criminal network.
The U.S. Attorney’s Office for the District of Nebraska unsealed two sweeping indictments charging 54 individuals for their alleged roles in a nationwide ATM “jackpotting” conspiracy tied to the violent Venezuelan criminal organization Tren de Aragua (TdA). Prosecutors say the group deployed sophisticated malware to force ATMs across the United States to dispense cash, stealing millions of dollars and funneling the proceeds back to TdA leadership.
U.S. Attorney for the District of Nebraska
The first indictment, returned December 9, 2025, charges 22 defendants with crimes including conspiracy to provide material support to terrorists, conspiracy to commit bank fraud and bank burglary, computer‑related fraud, and money laundering. Prosecutors allege that TdA used the jackpotting scheme as a revenue stream to support its broader criminal activities, which span drug trafficking, extortion, kidnapping, and acts of violence throughout the Western Hemisphere.
On President Donald Trump’s first day in office, he designated TdA as a Foreign Terrorist Organization, bringing powerful legal and financial tools to bear, Breitbart Texas reported. More recently, the U.S. Department of War began engaging suspected TdA narco-trafficking boats.
Among those charged in the ATM scheme is Venezuelan entertainer Jimena Romina Araya Navarro, previously sanctioned by the U.S. Treasury Department’s Office of Foreign Assets Control. OFAC has alleged that Araya Navarro assisted TdA leader Héctor “Niño Guerrero” in escaping a Venezuelan prison in 2012 and has been photographed socially with him. She is now accused of providing material support to the terrorist group TdA through her alleged involvement in the jackpotting operation.
An indictment returned on December 9, 2025, charges 22 defendants with offenses corresponding to their role in the conspiracy, including conspiracy to provide material support to terrorists, conspiracy to commit bank fraud, conspiracy to commit bank burglary and fraud, and related activity in connection with computers, and conspiracy to commit money laundering, U.S. Attorney for the District of Nebraska’s office reported.
A previous October indictment brought similar charges against 32 individuals. The indictment includes 56 counts: one count of conspiracy to commit bank fraud; one count of conspiracy to commit bank burglary and computer fraud; 18 counts of bank fraud; 18 counts of bank burglary; and 18 counts of damage to computers.
U.S. Attorney for the District of Nebraska
If convicted, the defendants face a maximum term of imprisonment ranging between 20 and 335 years, prosecutors noted.
DOJ and FBI officials responded to the indictments, saying:
“As alleged, these defendants employed methodical surveillance and burglary techniques to install malware into ATM machines, and then steal and launder money from the machines, in part to fund terrorism and the other far-reaching criminal activities of TDA, a designated Foreign Terrorist Organization,” said Acting Assistant Attorney General Matthew R. Galeotti of the Justice Department’s Criminal Division. “The announcement of charges against 54 individuals today underscores both the scale of the alleged conspiracies and the tenacity of our investigators and prosecutors. The Criminal Division will not tolerate networks of thieves who breach the security of our financial system, including for the nefarious purpose of providing material support to terrorists.”
United States Attorney Lesley Woods said, “Many millions of dollars were drained from ATM machines across the United States as a result of this conspiracy and that money is alleged to have gone to Tren de Aragua leaders to fund their terroristic activities and purposes. A tirelessly dedicated team of Nebraska law enforcement agents and officers banded together to identify this vast international criminal network and to follow the money trail of this devastating financial crime back to its terroristic roots in Venezuela. The agents, analysts, detectives, and officers who came together on this case were able to expose this conspiracy from its lowest levels to the alleged mastermind behind the malware that was deployed against American ATMs all across the nation. The members of Nebraska law enforcement who selflessly dedicated themselves to this mission have not only made Nebraska safer from a designated terrorist organization by removing dozens of TdA members from Nebraska but have also dealt a blow to an organization with international reach and impact. This case demonstrates what state, federal, and local law enforcement officers can accomplish when they fully join forces. The United States Attorney’s Office stands ready to fight alongside our law enforcement partners to defeat any threat to national security and to Nebraska’s security. TdA members will find no safe harbor in the State of Nebraska.”
“TdA poses a direct threat to our communities both here in the Midwest and across our country. This violent terrorist organization relies on a wide range of criminal activities to generate revenue supporting their campaigns of violence and terror. This case highlights TdA’s plot to deploy sophisticated malware targeting financial institutions across the U.S., syphoning millions of dollars from American banks to fund acts of terrorism,” said Special Agent in Charge Eugene Kowel of the Federal Bureau of Investigation’s Omaha Field Office. “As criminal enterprises change tactics, we surge resources and adapt accordingly to protect the American people. FBI Omaha will continue standing shoulder to shoulder with our local, state, and federal partners in the fight to dismantle and disrupt the activities of TdA in our neighborhoods and across the globe.”
“Tren de Aragua is not just a criminal gang; they are a ruthless terrorist organization that preys on communities, spreads fear, and bankrolls violence across borders. HSI and our law enforcement partners will track you down, break up your networks, and ensure you never find safe harbor in the United States,” said HSI Kansas City Special Agent in Charge Mark Zito. “Our mission is to protect American families from predators who think they can operate with impunity. We will not tolerate foreign terrorists stealing from our citizens and threatening our homeland. Our communities are safer today because of the relentless work of this team, and we are just getting started.”
TDAs gang members flooded into the United States during the Biden-era border crisis — often entering illegally while embedded in large groups of border crossers in Texas, Arizona, New Mexico, and California, Breitbart previously reported.
The DOJ describes TdA as “a violent transnational criminal organization that originated as a prison gang in Venezuela in the mid-2000s. TdA has expanded its criminal network throughout the Western Hemisphere and established a presence in the United States.”
Officials offered the following description of the alleged ATM scheme:
The alleged conspiracy developed and deployed a variant of malware known as Ploutus, which was used to hack into ATMs and force ATMs to dispense cash. The conspiracy relied on the recruitment of a number of individuals to deploy Ploutus malware nationwide. Members of the conspiracy and TdA would travel in groups, using multiple vehicles, to the locations of targeted banks and credit unions. These groups would conduct initial reconnaissance and take note of external security features at the ATMs. Following this reconnaissance, the groups would open the hood or door of ATMs and then wait nearby to see whether they had triggered an alarm or a law enforcement response. The groups would then take steps to install malware on the ATMs, by removing the hard drive and installing the malware directly, by replacing the hard drive with one that had been pre-loaded with the Ploutus malware, or by connecting an external device such as a thumb drive that would deploy the malware. The Ploutus malware’s primary purpose was to issue unauthorized commands associated with the Cash Dispensing Module of the ATM in order to force withdrawals of currency. The Ploutus malware was also designed to delete evidence of malware in an effort to conceal, create a false impression, mislead, or otherwise deceive employees of the banks and credit unions from learning about the deployment of the malware on the ATM. Members of the conspiracy would then split the proceeds in predetermined portions.
Earlier this week U.S. Attorney’s Office for the Southern District of New York charged four Venezuelan nationals, including suspected leaders of the violent Tren de Aragua (TdA) gang and one of FBI Houston’s “Top Ten” fugitives, as part of a nationwide crackdown that has now netted more than 70 alleged members tied to murders, kidnappings, and drug trafficking, Breitbart Texas reported.
“Hector Guerrero Flores is the alleged leader of a Venezuelan foreign terrorist organization sowing violence, murder, and misery into communities and nations throughout the Western Hemisphere,” said FBI Houston Special Agent in Charge Douglas Williams. “Under the leadership of Guerrero Flores, Tren de Aragua translates the suffering and death of thousands into profits for its members. Tren de Aragua, under the guidance of Guerrero Flores, saw members commit murders; violent robberies; sex trafficking; and weapons and narcotics trafficking impacting communities across the United States.”
Guerro Flores, known as “Niño Guerrero,” “El Cejón,” and“El Innombrable,” was indicted in the Southern District of New York, according to a statement released by the U.S. Attorney’s Office. He is charged with his alleged role as a leader in the TdA transnational criminal organization. His whereabouts are currently not known, prosecutors stated. The DOJ announced a $5 million reward for information leading to his arrest and/or conviction.
The Trump administration, through the Departments of Justice and Homeland Security, continue their efforts to rid the nation of these terrorists who were released into the U.S. during the Biden border crisis.
Bob Price is the Breitbart Texas-Border team’s associate editor and senior news contributor. He is an original member of the Breitbart Texas team. Price is a regular panelist on Fox 26 Houston’s What’s Your Point? Sunday morning talk show. He also serves as president of Blue Wonder Gun Care Products.
