Overview
- An indictment returned January 26 in the District of Nebraska adds 31 defendants, bringing the total charged in the ATM malware probe to 87.
- Court filings describe a repeatable method: crews scouted ATMs for law-enforcement response, gained internal access, and deployed Ploutus via preloaded drives or thumb drives.
- The malware issued unauthorized commands to cash modules and was designed to delete evidence of its presence to hinder detection by banks and credit unions.
- Many defendants are Venezuelan and Colombian nationals, including alleged Tren de Aragua members, and prosecutors say stolen funds were routed to the gang’s leadership to support violent activities.
- Charges span material support to a designated foreign terrorist organization, bank fraud and burglary, computer fraud and damage to protected computers, and money laundering, with the interagency probe ongoing under HSTF/JTF Vulcan with FBI and Secret Service support.