Alleged Tren de Aragua Members Charged in Multi-State ATM Malware “Jackpotting” Operation Across New England

Federal prosecutors have charged two Venezuelan nationals believed to be associated with the transnational criminal organization Tren de Aragua in connection with a coordinated ATM malware operation that targeted financial institutions across multiple New England states.

According to federal court filings, Moises Alejandro Martinez Gutierrez, 29, and Lestter Guerrero, 29, have been charged with conspiracy to commit bank theft in connection with a series of ATM jackpotting incidents and attempted attacks carried out across Massachusetts, Maine, New Hampshire, Connecticut, and Rhode Island.

Authorities state that both men are present in the United States without lawful status. Federal court proceedings related to the charges are expected to take place in Boston federal court.

Multi-State ATM Malware Operation

The charges stem from an ongoing federal investigation into a coordinated network believed to involve members of Tren de Aragua, a criminal organization originating in Venezuela that has expanded its operations throughout parts of the Western Hemisphere.

Investigators allege that the suspects participated in ATM jackpotting attacks, a cyber-enabled financial crime that involves directly manipulating an ATM’s internal software in order to force the machine to release its entire cash supply.

Unlike traditional ATM theft methods, jackpotting operations often rely on specialized malware or physical access to ATM hardware that allows attackers to override internal controls.

Once the malware is installed or the system is manipulated, operators can issue commands that trigger the ATM to dispense cash continuously, often referred to by investigators as “spitting” or “puking” money.

Nationwide Investigation Into Organized Jackpotting Networks

Federal investigators say the New England attacks are part of a broader nationwide conspiracy involving coordinated jackpotting crews linked to the Tren de Aragua organization.

The criminal network allegedly deploys teams that travel between cities targeting ATMs located in banks, retail stores, and standalone kiosk locations.

Typical jackpotting operations involve several roles:

• Technical operators who install malware or connect external hardware to the ATM
• Lookouts who monitor surrounding areas for law enforcement presence
• Cash collectors who retrieve the money once the machine begins dispensing
• Logistics coordinators who move crews between target locations

Investigators say these crews frequently conduct multiple attacks across different states within a short period of time to maximize profits and complicate investigative tracking.

Arrest Following Attempted Jackpotting Attack

According to federal charging documents, the investigation led to the arrest of Martinez Gutierrez and Guerrero on February 5, 2026, in Augusta, Maine, after authorities disrupted an attempted ATM jackpotting operation.

Investigators allege that Martinez Gutierrez is connected to several additional jackpotting attacks across New England.

The incidents cited in the charging documents include:

• Dec. 31, 2025 — Norwich, Connecticut
• Jan. 20, 2026 — Braintree, Massachusetts
• Jan. 30, 2026 — Rochester, New Hampshire

Authorities also allege involvement in attempted jackpotting operations at additional locations, including:

• Jan. 14, 2026 — Coventry, Rhode Island
• Jan. 19, 2026 — Stoneham, Massachusetts

Guerrero is accused of participating in at least one of the completed attacks alongside Martinez Gutierrez in Rochester, New Hampshire.

Financial Structure of the Criminal Operation

Federal investigators say proceeds from jackpotting operations tied to the network are typically divided according to internal rules established by the organization.

Charging documents indicate that approximately half of the stolen funds are sent to leadership figures associated with the organization, while the remaining portion is divided among participants involved in the ground operation.

This revenue-sharing model allows the criminal organization to maintain centralized control while deploying decentralized crews to conduct operations in different regions.

Tren de Aragua Expansion

Tren de Aragua originated in Venezuela in the mid-2000s and has grown into a transnational criminal network involved in a wide range of illegal activities.

Authorities attribute numerous criminal enterprises to the group, including:

• Human smuggling operations
• Extortion networks
• Drug trafficking
• Kidnapping operations
• Organized robbery schemes
• Cyber-enabled financial crimes

The group has increasingly been linked to financial cybercrime techniques, including ATM jackpotting and digital payment fraud.

Law enforcement agencies have reported that the organization uses mobile operational cells that can move between cities and countries to carry out crimes while avoiding long-term detection.

Technical Aspects of ATM Jackpotting

ATM jackpotting attacks have evolved over the past decade as organized crime groups began targeting financial infrastructure through direct hardware access.

Modern jackpotting methods may involve:

• Opening ATM cabinets using stolen keys or forced entry
• Connecting external laptops or specialized devices to internal ATM ports
• Installing malware capable of overriding cash dispenser controls
• Sending commands that force the ATM to release stored currency

In many cases, attackers target older ATM systems that still run outdated operating environments, making them more vulnerable to exploitation.

Financial institutions have increasingly implemented security upgrades including:

• Hardware intrusion detection sensors
• Remote ATM monitoring systems
• Software patching and firmware updates
• Enhanced camera coverage and physical locking mechanisms

Potential Penalties

The charge of conspiracy to commit bank theft carries a maximum penalty of:

• Up to five years in federal prison
• Up to three years of supervised release
• A fine of up to $250,000

Actual sentences, if convictions occur, are determined by federal judges based on statutory sentencing guidelines and the circumstances of the case.

Federal and Regional Investigation

The investigation involves cooperation among multiple federal and regional law enforcement agencies focused on organized crime and financial infrastructure protection.

Authorities from several jurisdictions across New England assisted in identifying the suspects and tracking the multi-state activity pattern.

Federal prosecutors assigned to organized crime and gang enforcement units are handling the prosecution.

Under U.S. law, the charges filed in court are allegations. The defendants are presumed innocent unless proven guilty beyond a reasonable doubt through the federal judicial process.

---

---

---

---

---

---

---

---

---

---

🔥 NOW AVAILABLE! 🔥

‎👉 Eclipsera – Apple Music

---

---

---

---

---