Lawyer working with lawsuit in courtroom, Criminal and judgement concept..
A Nebraska grand jury returned a third multi-count indictment on Monday charging 31 additional suspects in connection with an international terrorist organization that allegedly carried out 98 more bank and credit union ATM jackpotting attacks, resulting in more than $6 million in losses.
As with the first two indictments, the third alleged the ATM jackpotting scheme was coordinated by Tren de Aragua (TdA), a U.S.-designated Foreign Terrorist Organization, that originated as a Venezuelan prison gang in the mid-2000s, according to federal authorities.
In October and December 2025, the same grand jury returned two other indictments against 54 suspects who collectively and allegedly committed 149 bank and credit union ATM jackpotting attacks for a loss of more than $6 million.
Following the third indictment, federal authorities have charged a total of 85 suspects who allegedly committed 247 bank and credit union ATM jackpotting attacks across the U.S. for a total loss of more than $12 million. In addition to Nebraska, the suspects also targeted ATMs and ITMs in 14 other states, including Texas, Colorado, New York, New Mexico, Utah, Kansas, Washington, Iowa, Oklahoma, Tennessee, Missouri, Oregon, Michigan and California.
Members of the conspiracy, including TdA operatives, traveled in groups in rental cars to targeted banks and credit union ATMs. New court documents revealed that suspects were sent a "task list" message generated by "Vercel," a software app used by the overarching conspiracy to coordinate the ATM jackpotting scheme. One such list included the names and addresses of five Nebraska credit unions, including One Nebraska Federal Credit Union, Omaha Federal Credit Union, Metro Credit Union, LincOne Federal Credit Union and Liberty First Credit Union.
Once the suspects arrived at the targeted ATMs, they conducted initial reconnaissance and took notes of external security features at the cash machines. They would then open the hood or door of ATMs and wait nearby to see whether they had triggered an alarm or a law enforcement response.
The groups then removed the ATM's hard drive and replaced it with a hard drive preloaded with Ploutus malware or connected to an external device such as a thumb drive that would deploy the malware. Ploutus malware's primary purpose was to issue unauthorized commands associated with the cash dispensing module of the ATM to force withdrawals of cash. The Ploutus malware was also designed to delete evidence of malware to conceal or deceive employees of the banks and credit unions from learning about the deployment of the malware on the ATM.
In October 2025, Dubuque, Iowa police were dispatched to a DuTrac Community Credit Union ATM after an alarm was triggered when suspects opened its hood. ATM surveillance cameras, internal logs showing jackpotting events and license plate readers helped investigators identify and arrest four suspects: Cesar Antonio Idrogo-Rengel, Alana Rendiles, Winder M. Cardenas-Sayabedra and Wilson E. Colmenarez. They were among the 31 suspects named in the Jan. 26 indictment. The indictment charged the suspects with 32 felony counts including conspiracy to commit bank fraud, conspiracy to commit bank burglary and computer fraud, bank fraud, bank burglary and damage to computers.
Although the indictment did not name the ATM credit unions, they were located in Kearney, Columbus, Central City and Lincoln, Neb.; Dubuque, Iowa, Berwyn Ill.; and Warr Acres, Okla. The bank ATMs were located in Well Fargo, N.D.; Dubuque, Iowa; Irvington, N.J.; and Lincoln, Waverly, McCook and Grand Island, Neb.
Peter Strozniak can be reached at peter.strozniak@arc-network.com.
© Touchpoint Markets, All Rights Reserved. Request academic re-use from www.copyright.com. All other uses, submit a request to TMSalesOperations@arc-network.com. For more information visit Asset & Logo Licensing.