Feds indict nearly 100 alleged members of TdA gang for hacking bank ATMs nationwide, including Colorado

The U.S. Department of Justice says a violent Venezuelan gang which has a history of illegal activity in Colorado is responsible for stealing more than $6 million from American banks across the country. 

Ninety-eight people with ties to Tren de Aragua have been named in indictments that accuse them of installing viruses into ATMs. The virus allows the machines to dispense sometimes hundreds of thousands of dollars at a time. 

ATMs in 26 states — including Colorado, Wyoming, and, in particular, Nebraska — were physically broken into over the course of two years (January 2024 to February 2026), according to court documents. Most of the incidents detailed in the indictments occurred in Nebraska. One Nebraska credit union, for instance, lost $300,000 in a single weekend in August 2025 to the scheme.

Consequently, the DOJ made its district office in Nebraska the hub for the prosecutions. A grand jury based in Omaha produced the indictments, one in October 2025 and another in February of this year.

“The investigation has established extensive direct and indirect links between the indicted co-conspirators and TdA,” the DOJ stated in a press release.   

Details in the indictments, plus other documents released publicly by the DOJ, explain how alleged TdA members would choose ATMs to target, first studying their security measures, then breaking into them and connecting a cable to the ATM’s hard drive. A malware named Ploutus was then installed. In some cases, the ATM’s hard drive was swapped out entirely with another hard drive already loaded with the Ploutus malware, according to the indictments. 

The malware enabled operators, some working remotely, to bypass the bank’s normal verifications systems and order the dispensing of cash. The operators who physically installed the malware in the ATMs were often receiving instruction from other members of the accused group via phone or video conference, according to the indictments.  

In addition, the Ploutus malware covered its own tracks. It contained “anti-analysis measures to hinder forensic review,” as stated in one indictment. It would even delete itself to avoid detection.

Federal investigators termed the theft from ATMs “jackpotting.” They estimated the total loss to American banks due to the scheme at $6,126,321. It was also estimated the group attempted to steal an additional $1,740,807 but failed. 

“ATM jackpotting is TdA’s business plan and their assessed primary source of revenue to fund their terrorist activities that range from reprehensible forms of human trafficking to armed robbery, murder, and the general undermining of America’s national security by flooding our communities with controlled substances,” U.S. Attorney Lesley Woods for the District of Nebraska stated in a press release. “We will use these prosecutions to put a chokehold on their funding pipeline.”  

The “jackpotting” conspiracy struck two Colorado banks. According to an indictment, an ATM at McCook National Bank in Burlington was struck in February 2025. Another at Points West Bank in Wellington was hit in three months later.

The Denver office of the Federal Bureau of Investigation recently acknowledged on social media that “numerous ATMs” in both Colorado and Wyoming were successfully targeted by the jackpotting operation. 

“The FBI Denver cyber agents worked with local law enforcement to collect evidence from the impacted locations that was used in the prosecution of the conspiracy,” the office stated in its post.

Those local agencies, as listed in a DOJ press release: Denver, Glendale, Aurora and Sheridan police departments, and Adams County, Douglas County, Larimer County and Lake County sheriff’s offices. 

Two men, 36-year-old Carlos Javier Padron and 37-year-old Oddry Arnoldo Cabrera Torrealba, were both sentenced three weeks ago for deploying malware in ATMs. Both received 78-month federal prison terms. They were also ordered to jointly pay $1,537,696 in restitution to several banks.

Both Padron and Torrealba are Venezuelan nationals who are in the U.S. illegally, the DOJ stated in a press release. The were arrested at the site of a jackpotting incident in Lincoln, Nebraska, in October 2024. 

The group was also believed responsible for similar activity internationally. Venezuela, Colombia, Mexico, Spain, El Salvador and Honduras were listed in an indictment, but more countries were thought be victimized by the group. 

Aside from those accused of physically breaking into the ATMs, the group’s members include alleged TdA members who deposited funds in bank accounts, converted money to bitcoin, and distributed payouts to other members of the group. Those suspects are charged with money laundering. 

Other accused members of the group are facing charges of materially supporting a terrorist organization, a label given to TdA by the U.S. government in 2025. This group includes Jimena Romina Araya Navarro, (a.k.a. “Rosita”), a Venezuelan DJ, actress and model whose stage named is “Rosita.” Navarro was sanctioned by the U.S. government that year for her affiliations with TdA. The Treasury Department, in press release, called Navarro a TdA leader and accused her of helping the notorious head of TdA, Hector Rusthenford Guerrero Flores (a.k.a. “Niño Guerrero”) escape from the Tocorón prison in Venezuela in 2012.

In that 2025 press release about Navarro, the federal government claimed she was is part of a network of five persons affiliated with the Venezuelan entertainment industry that have provided material support to TdA.

The Treasury Department’s sanction means she is legally blocked from participating in any financial transactions with U.S. entities or persons.

Other charges against the jackpotting suspects include bank fraud, bank burglary, computer fraud, and damage to computers.  

Information from the DOJ and the indictments does not indicate how many of the named members of the conspiracy are currently in ederal custody, nor how many remain at large.

If convicted, each of the defendants faces maximum penalties of between 20 and 335 years in prison, per the DOJ.