The U.S. Department of Justice has indicted 54 individuals linked to a major ATM jackpotting scheme that reportedly siphoned millions of dollars. This conspiracy involved the use of Ploutus malware to hack ATMs, forcing them to dispense cash. The group is tied to Tren de Aragua (TdA), a Venezuelan gang classified as a foreign terrorist organization by the U.S. State Department. Notably, this is not just about ATM theft; the gang is also implicated in drug trafficking, human smuggling, and extortion. The indictment, returned on December 9, 2025, charges 22 people with bank fraud, burglary, and money laundering. An earlier indictment from October 21, 2025, involved 32 additional suspects facing multiple counts of conspiracy and fraud. If convicted, these defendants could face prison sentences ranging from 20 to 335 years. The operation relied on a network of recruits who conducted surveillance on ATMs, installed Ploutus using methods like replacing hard drives or connecting thumb drives, and then executed cash withdrawals through unauthorized commands. Ploutus malware first appeared in Mexico in 2013 and has evolved to exploit vulnerabilities in various ATM models. Once installed, it allows a "money mule" to withdraw substantial amounts of cash quickly, provided they have the necessary tools and access codes. Since 2021, the U.S. has recorded 1,529 jackpotting incidents, resulting in losses exceeding $40 million. This money has allegedly funded TdA's criminal activities, further establishing the gang's reach and the broader implications of this cybercrime.