Clarissa Hana
Five Venezuelan nationals have entered guilty pleas for their involvement in a sophisticated conspiracy to defraud automated teller machines (ATMs) through the use of malware, a criminal tactic known as "jackpotting." The individuals, identified as Luis Alberto Velasquez-Artigas, 27; Royder Adrian Figuera-Perez, 29; Javier Mejia, Jr., 27; Gabriel Alexjandro Corales-Garcia, 33; and Italo Lizandro Corrales-Carrillo, 26, all admitted to one count of conspiracy to commit bank larceny. This development marks a significant step in the ongoing law enforcement efforts to dismantle organized criminal networks exploiting vulnerabilities in financial technology.
While Luis Alberto Velasquez-Artigas has already received a nine-month prison sentence, the remaining defendants are currently awaiting their sentencing. The U.S. Attorney for the District of Kansas, Ryan A. Kriegshauser, highlighted the evolving nature of these criminal enterprises. "Jackpotting bandits are sweeping the nation," Kriegshauser stated in a press release. "This particular group’s strategy was to specifically target ATMs they thought were by design more vulnerable to malware." His remarks underscore a critical aspect of these attacks: the perpetrators’ deliberate selection of machines perceived as easier targets, often those running older or less secure operating systems.
The Mechanics of ATM Jackpotting
ATM jackpotting is a form of cybercrime that bypasses the typical transaction process of an ATM to force the machine to dispense all available cash. This is achieved by infecting the ATM’s internal computer system with specialized malware. Once installed, this malicious software allows criminals to remotely control the ATM, issuing commands that override its normal operational protocols. Typically, attackers gain physical access to the ATM to install the malware, often through a USB port. They may then use an external USB keyboard or the ATM’s own PIN pad to interact with the compromised system. The malware then instructs the cash dispenser to repeatedly eject bills from the cassette, effectively emptying the machine.
A variety of malware strains have been identified and utilized in these sophisticated attacks over recent years, including ATMii, ATMitch, GreenDispenser, Alice, RIPPER, Skimer, SUCEFUL, and Ploutus. Each of these malware families possesses unique characteristics and functionalities, but their ultimate goal remains the same: to illicitly extract cash from ATMs. The FBI has previously issued warnings about the increasing prevalence and financial impact of these attacks, noting a substantial surge in stolen funds attributed to this method.
A Failed Attempt and Subsequent Arrests
The five Venezuelan nationals were apprehended in December 2025, just days after their attempts to execute jackpotting attacks in Wamego and Manhattan, Kansas, were thwarted. Surveillance footage captured their efforts to install malware on ATMs in both locations. In Wamego, the conspirators were unsuccessful in their attempt to install the malware. However, their actions triggered an alarm system, prompting a swift response from law enforcement. The Justice Department noted that the culprits did not return to the site after the alarm was activated.
In Manhattan, the group also failed to achieve their objective of dispensing cash from the targeted ATM. Both incidents, though unsuccessful in terms of cash theft, provided crucial evidence. The surveillance footage captured the perpetrators in the act, enabling law enforcement to identify and subsequently arrest them a few days later. This highlights the critical role of physical security measures and surveillance in aiding investigations into these technologically advanced crimes.
Broader Trends and Law Enforcement Response
The arrests and guilty pleas in Kansas are part of a wider, nationwide crackdown on ATM jackpotting operations. In February of the same year, the FBI issued a stark warning: criminals had stolen over $20 million in the preceding year through a significant escalation of ATM jackpotting incidents. This warning followed a wave of arrests targeting members of the Tren de Aragua, a Venezuelan transnational criminal organization. This group was strongly linked to a large-scale ATM jackpotting scheme that employed the Ploutus malware, leading to the theft of millions of dollars from ATMs across the United States.
The comprehensive nature of the law enforcement response is evident in the scale of charges brought against members of the Tren de Aragua. In total, the Justice Department has charged 87 members of this organization in connection with various criminal activities, including ATM jackpotting. The potential penalties for these individuals are severe, with maximum prison terms ranging from 20 to an astounding 335 years, reflecting the gravity and complexity of the offenses.
Deterrence and Technological Countermeasures
The U.S. Attorney’s Office is actively encouraging financial institutions to bolster their defenses against such attacks. U.S. Attorney Ryan A. Kriegshauser emphasized the availability of technological solutions designed to counter jackpotting. "Fortunately, there is technology to help thwart jackpotting," he stated. "We at the U.S. Attorney’s Office encourage banks and other financial institutions to invest in these updates, and we’re happy to answer questions about how to do so."
This call to action underscores the ongoing technological arms race between criminals and security professionals. Financial institutions are urged to continuously update their ATM software and hardware, implement robust network security protocols, and deploy advanced threat detection systems. The use of outdated operating systems, such as Windows 7 and Windows Vista, has been identified as a significant vulnerability exploited by malware like ATMii. Modernizing ATM infrastructure is a crucial step in mitigating the risk of successful jackpotting attacks.
International Dimensions and Deportation
The Venezuelan origin of many individuals involved in these ATM jackpotting schemes has also brought international dimensions to the forefront of law enforcement efforts. In a related development in January of the same year, South Carolina federal prosecutors announced that two Venezuelan nationals convicted of jackpotting attacks would be deported following the completion of their prison sentences. This indicates a coordinated approach that combines criminal prosecution with immigration enforcement, aiming to prevent recidivism and address the transnational nature of these criminal networks.
The systematic exploitation of ATMs by organized criminal groups poses a significant threat to the financial sector and public trust in banking infrastructure. The guilty pleas entered by the five Venezuelan nationals represent a success for law enforcement in disrupting one such operation. However, the persistent threat of ATM jackpotting necessitates continuous vigilance, technological innovation, and robust international cooperation to safeguard financial systems and protect consumers from financial fraud. The ongoing investigations and prosecutions serve as a testament to the commitment of law enforcement agencies to combatting these sophisticated cybercrimes.
The Evolving Threat Landscape
The prevalence of ATM jackpotting attacks is not an isolated phenomenon but part of a broader trend in cyber-enabled financial crime. Criminals are constantly seeking new vulnerabilities and methods to exploit. The sophistication of the malware used, coupled with the organizational capacity of criminal networks, presents a formidable challenge. The FBI’s warning about the $20 million stolen in 2025 serves as a stark reminder of the financial impact, but the damage extends beyond monetary losses to include reputational harm for financial institutions and potential erosion of consumer confidence.
The fact that this particular group targeted ATMs they believed to be "more vulnerable to malware" highlights a strategic approach by criminals. They often conduct reconnaissance, identifying weak points in the security of individual machines or entire ATM networks. This could involve exploiting unpatched software, weak physical security, or compromised network connections. The reliance on older operating systems remains a persistent issue, as many financial institutions have been slow to fully upgrade their legacy systems due to the cost and complexity involved.
Analyzing the Implications
The successful prosecution of these individuals, while a positive outcome, also underscores the need for proactive measures. The U.S. Attorney’s Office’s encouragement for banks to invest in security updates is a practical recommendation. The cost of implementing advanced security measures, while significant, is often far less than the potential losses incurred from a successful jackpotting attack. Furthermore, the reputational damage from a widely publicized breach can have long-lasting consequences.
The involvement of transnational criminal organizations like Tren de Aragua adds another layer of complexity. These groups often operate with a high degree of organization, resources, and a willingness to engage in violence, making them particularly challenging to combat. Their operations can span multiple jurisdictions, requiring extensive international cooperation between law enforcement agencies. The deportation of convicted individuals, while a necessary step, also highlights the ongoing challenge of preventing individuals from engaging in criminal activities upon their return to their home countries.
A Look Ahead
The ongoing battle against ATM jackpotting requires a multi-faceted approach. This includes:
- Technological Advancement: Financial institutions must prioritize the adoption of the latest security technologies, including encryption, secure boot processes, and intrusion detection systems. Regular software updates and patches are non-negotiable.
- Physical Security: While the attacks are cyber-enabled, physical access is often required for initial malware installation. Enhancing the physical security of ATM locations, including surveillance and tamper-evident seals, can deter attackers.
- Information Sharing: Collaboration and the timely sharing of threat intelligence between financial institutions and law enforcement agencies are crucial for identifying emerging threats and developing effective countermeasures.
- International Cooperation: Given the transnational nature of many of these criminal networks, robust international partnerships are essential for tracing illicit funds, apprehending suspects, and dismantling criminal organizations.
- Public Awareness: Educating the public about ATM safety and the risks associated with certain types of scams can also play a role in prevention.
The guilty pleas in this case serve as a reminder that while technological vulnerabilities can be exploited, determined law enforcement efforts, coupled with strategic investments in security, can bring perpetrators to justice. The fight against sophisticated financial crimes like ATM jackpotting is an ongoing one, demanding continuous adaptation and collaboration from all stakeholders.
