Credit/Shutterstock
A new indictment in an ongoing and expansive case revealed an international terrorist organization allegedly committed an additional 117 bank and credit union ATM jackpotting attacks that caused more than $5.4 million in losses.
The indictment, numbered by authorities as document 242, charged 22 individuals who were allegedly involved in the ATM jackpotting scheme.
This indictment was related to another that CU Times has previously reported on, numbered by authorities as document 190, which alleged that 32 individuals targeted 12 credit union ATMs and 20 bank ATMs in Nebraska, where many of the ATM jackpotting attacks occurred.
What's more, a second part of these indictments has been kept under seal as of Tuesday by federal authorities.
In all, 54 suspects were alleged to be members of the Tren de Aragua (TdA), a U.S.-designated Foreign Terrorist Organization, that originated as a Venezuelan prison gang in the mid-2000s, according to Acting Assistant Attorney General Matthew R. Galeotti of the Justice Department's Criminal Division. According to court documents, TdA expanded its criminal network from Venezuela to throughout the Western Hemisphere.
The organization's criminal activities were drug trafficking, firearms trafficking, commercial sex trafficking, kidnapping, robbery, theft, fraud and extortion.
In addition to Nebraska, the suspects also targeted ATMs and ITMs in 14 other states, including Texas, Colorado, New York, New Mexico, Utah, Kansas, Washington, Iowa, Oklahoma, Tennessee, Missouri, Oregon, Michigan and California. After breaking into the machines, they installed Ploutus malware to the ATM's cash‑dispensing module, tricking the machine to roll out large amounts of cash without a member card or PIN.
The malware also erased itself to avoid detection.
Even though indictments 242 and 190 charged the 54 suspects with multiple felony counts of conspiracy to commit bank fraud and computer fraud, the 242 indictment also charged the 22 suspects with conspiracy to commit money laundering and a conspiracy to provide material support to terrorists.
Indictment 242 did not identify the credit unions and banks that were victimized, but indictment 190, as reported by CU Times last month, did identify the credit unions and banks, as well as details about each ATM jackpotting attack.
The 32 suspects named in the 190 indictment targeted 12 credit unions and 20 banks. They allegedly stole $366,800 from six credit unions and attempted to steal $506,583 from seven credit union ATMs. Additionally, 12 compromised bank ATMs suffered $722,620 in losses. An additional eight attacks involved attempted thefts totaling $515,027. The combined total loss and attempted loss from all credit union and bank ATMs was more than $2.1 million, according to indictment 190.
In addition to the $5.4 million in losses recorded in the 242 indictment, there was an additional $1.4 million in attempted ATM losses, bringing the grand total of losses and attempted losses to more than $8.9 million.
The losses to victim financial institutions that were not named in indictment 242 were sometimes more than $100,000.
For example, on Aug. 16 and Aug. 17, 2025, members of the alleged conspiracy committed two ATM jackpotting attacks and stole $300,000 from a Kearney, Neb.-based credit union. In a separate court case, numbered by federal authorities as 508, a criminal complaint described these jackpotting attacks that were allegedly committed by Carlos Hernandez Moreno and an individual who was not named in the criminal complaint.
Moreno was indicted separately and has pleaded not guilty to bank burglary and damage to a protected computer. His jury trial has been scheduled for February. Moreno, however, was not listed as a defendant on indictments 242 and 190.
A spokesperson for the Nebraska's U.S. Attorney's office did not respond to a CU Times request for additional information.
READ MORE: Criminal Indictment 242 and Criminal Indictment 190.
Peter Strozniak can be reached at peter.strozniak@arc-network.com.
© Touchpoint Markets, All Rights Reserved. Request academic re-use from www.copyright.com. All other uses, submit a request to TMSalesOperations@arc-network.com. For more information visit Asset & Logo Licensing.