Authorities have charged at least 87 people linked to the Venezuelan group Tren de Aragua (TdA) in connection with a large-scale scheme involving the theft of millions from ATMs across the nation. This criminal activity, known as “ATM jackpotting,” has been a significant focus of law enforcement efforts.

The U.S. Attorney’s Office for the District of Nebraska revealed on Monday that 31 new defendants have been added to a list that already includes 56 individuals previously charged. This is part of an extensive operation led by a Homeland Security Task Force.

The criminal network, primarily consisting of Venezuelan and Colombian nationals associated with TdA, reportedly used the stolen money to fund various terrorist activities. These include human trafficking, child sex trafficking, kidnapping, and murder, along with other violent and heinous acts, according to U.S. Attorney Lesley A. Woods of the District of Nebraska.

“Tren de Aragua is a sophisticated terrorist group involved in severe financial crimes alongside brutal acts such as rapes, murders, and drug trafficking,” stated Attorney General Pamela Bondi.

An ATM with its panel open illustrates the method used by the perpetrators to install malware, compelling the machines to dispense cash. (Department of Justice)

“The Department of Justice has already prosecuted over 290 members of Tren de Aragua and remains dedicated to bringing these dangerous terrorists to justice, following their infiltration during the previous administration,” Bondi further commented.

January’s indictment alleges 32 counts involving bank fraud, bank burglary, computer fraud and damage to computers.

Surveillance image shows a suspect holding large amounts of cash allegedly stolen during an ATM “jackpotting” operation tied to Tren de Aragua. (Department of Justice)

According to the Justice Department, members allegedly hacked into ATMs and forced machines to dispense cash by deploying a malware variant known as Ploutus, which was designed to delete evidence of its presence in an effort to conceal the crime.

A hooded individual is seen taking a photo during what investigators say was part of an ATM fraud operation linked to Tren de Aragua. (Department of Justice)

Officials said members arrived at targeted banks and credit unions to scout ATMs and note any external security features. The groups would then open the hood or door of the machines and wait to determine whether an alarm or a law enforcement response had been triggered. Once clear, the groups installed malware by removing the hard drive and installing the software directly, replacing the hard drive with one preloaded with Ploutus, or connecting an external device, such as a thumb drive, to deploy the malware.

Overhead surveillance footage captures a suspect near an ATM allegedly targeted during a nationwide “jackpotting” scheme. (Department of Justice)

The update follows two similar indictments last year in December and October. The total 87 individuals involved face a range of federal offenses, including material support to a designated foreign terror organization, bank burglary, bank fraud, money laundering, damage and unauthorized access to protected computers, and conspiracy to commit the same offenses.