Five Venezuelans Plead Guilty to US ATM Jackpotting Attacks

Five Venezuelan nationals have pleaded guilty to conspiring to commit bank larceny after attempting to use malware to force cash dispensers at US ATMs to release money.

Luis Alberto Velasquez-Artigas, Royder Adrian Figuera-Perez, Javier Mejia Jr., Gabriel Alexjandro Corales-Garcia and Italo Lizandro Corrales-Carrillo admitted their roles in the attempted ATM jackpotting attacks.

Velasquez-Artigas has received a nine-month prison sentence. The four other defendants are awaiting sentencing.

Group targeted ATMs in Kansas

Authorities arrested the five men in December 2025, days after failed attempts to install malware on ATMs in Wamego and Manhattan, Kansas.

The group failed to install the malware in Wamego, but the attempted installation triggered an alarm and prompted a law-enforcement response. Investigators said the suspects did not return to that location.

The defendants also failed to make an ATM in Manhattan release cash. Surveillance cameras recorded both incidents, and officers arrested the group days later.

How ATM jackpotting attacks work

ATM jackpotting attacks involve installing malware on an ATM’s internal computer. Criminals can then issue commands through a connected USB keyboard or the machine’s PIN pad to control the cash dispenser and empty the cassette holding banknotes.

Authorities said the group selected ATMs it believed were particularly vulnerable to malware-based attacks.

US Attorney Ryan A. Kriegshauser said banks and other financial institutions can deploy technology designed to prevent jackpotting. He urged affected organisations to invest in those protections.

Malware attacks have cost banks millions

Criminals have used numerous malware families in ATM jackpotting attacks over the years, including ATMii, ATMitch, GreenDispenser, Alice, RIPPER, Skimer, SUCEFUL and Ploutus.

The FBI warned in February that criminals stole more than $20 million in a major increase in ATM malware attacks during 2025.

US authorities have also pursued alleged members of the Venezuelan criminal organisation Tren de Aragua in connection with a large-scale scheme involving Ploutus malware. The Justice Department has charged 87 alleged members, with potential prison sentences ranging from 20 to 335 years.

In January, federal prosecutors in South Carolina announced that two Venezuelan nationals convicted over similar attacks would face deportation after completing their prison terms.