U.S. DOJ Charges 54 in ATM Jackpotting Scheme Using Ploutus Malware

According to the U.S. Department of Justice (DoJ), the indictment charges 54 individuals in a multi‑million dollar ATM jackpotting scheme that used the Ploutus malware to force ATMs to dispense cash across the United States. The indicted members are alleged to be part of Tren de Aragua (TdA), a Venezuelan gang designated a Foreign Terrorist Organization by the U.S. State Department.

In July 2025, sanctions were announced against TdA’s head and five other key members for involvement in various criminal activities, including the illicit drug trade and money laundering. The indictment returned on 9 December 2025 alleges 22 people committed bank fraud, burglary and money laundering, with a second related indictment on 21 October 2025 charging a further 32 individuals across multiple counts.

Prosecutors say TdA used surveillance and burglary to install Ploutus in ATMs, where it could trigger cash withdrawals and then delete malware evidence to mislead banks. The DoJ notes that 1,529 jackpotting incidents have been recorded in the U.S. since 2021, with about $40.73 million lost to the network as of August 2025.