Two Venezuelan nationals alleged to be members of the international criminal organization Tren de Aragua (TdA) have been accused of stealing more than $169,000 from credit union and bank ATMs in Connecticut, Massachusetts and New Hampshire, according to the U.S. attorney's office in Boston.
Federal authorities also alleged the Venezuelan nationals, Moises Alejandro Martinez Gutierrez and Lestter Guerrero, both 29, attempted to steal money from credit and bank ATMs in Rhode Island, Massachusetts and Maine. They have been charged with conspiracy to commit bank theft. During a court hearing last week, they did not enter a plea and remain in federal custody, court filings showed.
The FBI is investigating roughly 13 reported ATM jackpotting robberies and attempted robberies throughout the New England region that occurred from Dec. 1, 2025 to Feb. 5, 2026.
Including the arrest of Martinez Gutierrz and Guerrero, a total of 93 TdA individuals have been accused of allegedly conducting more than 100 credit union and bank ATM jackpotting attacks in 21 states, resulting in more than $6.1 million in losses. They also attempted to steal more than $1.7 million, according to court documents.
On Feb. 5, police arrested Martinez Gutierrez and Guerrero when they broke into an ATM at the Connected Credit Union location in Augusta, Maine. Police were called to the scene at about 3 a.m. after the ATM's alarm was triggered. None of the $56,460 in cash was stolen from Connected's ATM, federal investigators said.
Martinez Gutierrez was allegedly connected to at least five additional ATM jackpotting incidents across New England, including a robbery on Dec. 31, 2025, in Norwich, Conn., at the Ascend Bank ATM where $38,350 was stolen. On Jan. 20, 2026, he allegedly siphoned $72,500 from the Liberty Bay Credit Union ATM in Braintree, Mass., and $58,200 from the Granite State Credit Union in Rochester, New Hampshire on Jan. 30.
Martinez Gutierrez also allegedly attempted ATM jackpotting attacks at the Ocean State Credit Union location in Coventry, R.I., on Jan. 14, and at Stonehaven Bank in Stonehaven, Mass.
Guerrero was allegedly connected to the Granite State ATM robbery on Jan. 30, court documents showed.
The suspects allegedly split 50% of the stolen funds, then sent the remaining 50% to TdA's leadership in Venezuela.
According to the FBI, suspects involved in the TdA scheme typically use Ploutus malware to infect ATMs that force them to dispense cash. The malware exploits eXtensions for Financial Services, or XFS, the software layer that directs an ATM's functions. During legitimate transactions, ATM applications send instructions through XFS for bank authorization. But when criminals gain the ability to issue their own commands to XFS, they can bypass bank authorization and direct the machine to dispense cash on demand.
As a result, Ploutus allows criminals to withdraw money without using a bank card, member accounts or bank authorization. The malware targets the ATM itself rather than member accounts, enabling rapid cash-out operations that can occur within minutes and often go undetected until after the money is withdrawn.
More than 700 of the 1,900 ATM jackpotting attacks reported nationwide since 2020 occurred in 2025, causing more than $20 million in losses for credit unions and banks, according to the FBI. The surge prompted the FBI to release an actionable cyber intelligence statement last month urging organizations to implement recommended mitigation measures to help prevent ATM jackpotting incidents.
READ MORE: FBI Investigator's Affidavit.
Peter Strozniak can be reached at peter.strozniak@arc-network.com.
© Touchpoint Markets, All Rights Reserved. Request academic re-use from www.copyright.com. All other uses, submit a request to TMSalesOperations@arc-network.com. For more information visit Asset & Logo Licensing.