Tren de Aragua Indicted in Major ATM Malware Scheme

Federal prosecutors have charged 54 alleged members of the Venezuelan criminal organization Tren de Aragua (TdA) in connection with a sophisticated ATM malware scheme that reportedly siphoned millions of dollars from U.S. financial institutions. The U.S. Attorney’s Office for the District of Nebraska unsealed two indictments on December 9, 2025, detailing a nationwide conspiracy involving the deployment of malware to force ATMs to dispense cash. The charges include conspiracy to provide material support to terrorists, bank fraud, bank burglary, and money laundering.

BreitbartBreitbart

The indictments encompass 56 counts, including 18 counts each of bank fraud, bank burglary, and damage to computers. If convicted, the defendants face potential prison sentences ranging from 20 to 335 years. The malware, identified as Ploutus, was used to compromise ATMs, allowing the group to withdraw unauthorized cash. The operation involved methodical surveillance and the installation of malware through various means, including replacing hard drives and using external devices.

Breitbart

Tren de Aragua originated as a prison gang in Venezuela in the mid-2000s and has since evolved into a violent transnational criminal organization. The group is involved in various criminal activities, including drug trafficking, extortion, and kidnapping. The U.S. Department of Justice has designated TdA as a Foreign Terrorist Organization, which allows for enhanced legal and financial measures against its members.

Breitbart

Matthew R. Galeotti, Acting Assistant Attorney General of the Justice Department’s Criminal Division, emphasized the seriousness of the charges, stating, “These defendants employed methodical surveillance and burglary techniques to install malware into ATM machines, and then steal and launder money from the machines, in part to fund terrorism.” U.S. Attorney Lesley Woods highlighted the extensive financial impact of the conspiracy, noting that “many millions of dollars were drained from ATM machines across the United States.”

Breitbart

While the indictments have been met with support from law enforcement, some critics have raised concerns about the broader implications of linking immigration policies to criminal activities. The Biden administration's handling of the border crisis has been scrutinized, with critics arguing that it has facilitated the entry of criminal organizations like TdA into the U.S.

Breitbart

There is a lack of consensus regarding the exact financial impact of the ATM scheme, with estimates of the total amount stolen varying across sources. Additionally, the whereabouts of key figures within TdA, such as alleged leader Héctor “Niño Guerrero,” remain unknown, complicating the prosecution's efforts.

Breitbart

The ongoing investigation aims to dismantle the TdA network further, with law enforcement agencies continuing to pursue additional arrests and prosecutions. The case underscores the challenges posed by transnational criminal organizations and their ability to exploit vulnerabilities in the U.S. financial system.

Breitbart