Five Venezuelan nationals have pleaded guilty to a series of ATM jackpotting attacks across the United States, after surveillance cameras recorded their failed attempts to drain cash machines in two Kansas towns. The case is one thread in a much larger federal investigation that has now ensnared dozens of individuals linked to the Tren de Aragua criminal organisation.
Luis Alberto Velasquez-Artigas, Royder Adrian Figuera-Perez, Javier Mejia Jr, Gabriel Alexjandro Corales-Garcia, and Italo Lizandro Corrales-Carrillo each pleaded guilty to one count of conspiracy to commit bank larceny. Velasquez-Artigas, 27, has already been sentenced to nine months in prison; the remaining four are awaiting sentencing.
Caught on Camera in Kansas
The five were arrested in December 2025, days after two botched ATM jackpotting attacks in Wamego and Manhattan, Kansas. In Wamego, the group failed to install malware on the target machine, but the attempt triggered an alarm that brought law enforcement to the scene. ‘The culprits didn’t return to the site,’ the Justice Department noted in a press release. In Manhattan, the conspirators got no further: the ATM never dispensed cash, and both attempts were captured in full by surveillance cameras. The arrests followed a few days later.
The mechanics of jackpotting are straightforward, if brazen. Criminals install malware directly onto an ATM’s internal computer, then issue commands either via an attached USB keyboard or the machine’s built-in PIN pad to instruct the cash dispenser to empty its storage cassette. Malware families deployed in such attacks over the years include ATMii, ATMitch, GreenDispenser, Alice, RIPPER, Skimer, SUCEFUL, and Ploutus, among others. In this campaign, Ploutus malware was the tool of choice.
How ATM Jackpotting Attacks Fit the Bigger Picture
The Kansas guilty pleas are a small part of a sprawling federal effort. The U.S. Department of Justice has charged 87 Tren de Aragua members in connection with the wider ATM jackpotting scheme, with maximum prison terms ranging from 20 to 335 years each. A related indictment returned on 21 October 2025 charged 32 individuals and alleged 56 counts, including conspiracy to commit bank fraud, conspiracy to commit bank burglary and computer fraud, 18 counts of bank fraud, 18 counts of bank burglary, and 18 counts of damage to computers.
The scale of the problem extends well beyond Kansas. According to NewsNation, four Venezuelan nationals were arrested and charged with using malware and other specialised software to force ATMs in Connecticut to dispense more than $529,000, targeting nine machines in 2025. A separate case involved Richard Ferrer-Alvarez in a multistate operation that caused at least $200,000 in known losses. Two others, Carlos Javier Padron and Oddry Arnoldo Cabrera Torrealba, were each sentenced to 6½ years in prison after being convicted of helping to install malware on ATMs across the country.
In January, South Carolina federal prosecutors announced that two Venezuelan nationals convicted of jackpotting attacks would be deported after serving their sentences, adding an immigration dimension to prosecutions that are already spanning multiple jurisdictions.
The FBI warned in February that criminals stole over $20 million last year in a surge of ATM jackpotting incidents, a figure that underlines why federal prosecutors have treated the Tren de Aragua network’s cash-machine operations as a priority rather than a novelty.
With 87 members charged, dozens of cases pending sentencing, and the October 2025 indictment still working its way through the courts, the Kansas five are unlikely to be the last to face a judge over Ploutus-driven ATM jackpotting attacks on American soil.
