FEDERAL GRAND JURY CHARGES 54 IN MULTI-MILLION-DOLLAR TREN DE ARAGUA ATM JACKPOTTING CONSPIRACY

OMAHA, Neb. — Federal prosecutors have charged 54 individuals in two indictments stemming from an expansive ATM jackpotting investigation that authorities say used malware and physical intrusion to steal millions of dollars from banks and credit unions across the United States, followed by coordinated efforts to launder the proceeds.

The U.S. Attorney’s Office for the District of Nebraska announced the charges on December 18, 2025, after a federal grand jury returned a December 9 indictment charging 22 defendants and an earlier October 21 indictment charging another 32. The cases form part of a broader federal investigation into an alleged financial-crime network connected to Tren de Aragua, a Venezuelan transnational criminal organization designated by the United States as a Foreign Terrorist Organization in February 2025.

The December indictment, filed in the U.S. District Court for the District of Nebraska under case number 8:25-cr-00242-BCB-RCC, charges defendants with offenses that include conspiracy to commit bank fraud, conspiracy to commit bank burglary and computer fraud, conspiracy to commit money laundering and conspiracy to provide material support to terrorists. The charges are allegations, and the defendants are presumed innocent unless and until proven guilty.

Federal prosecutors identified Anibal Alexander Canelon Aguirre, also known as “Prometheus” and “The Engineer,” as one of the defendants charged in the December case. The government alleges that Canelon Aguirre participated in the conspiracy to deploy malware against ATMs and interactive teller machines belonging to federally insured financial institutions.

The malware identified in the case is a variant of Ploutus, an ATM-focused malicious software family that prosecutors allege was used to override normal machine controls and force ATMs to dispense cash through unauthorized commands.

Prosecutors allege crews first conducted reconnaissance against targeted ATMs, photographing machines, examining internal hardware and checking for security systems or silent alarms. Members of the group would then gain physical access to the machine and remove its hard drive or other storage device. Malware could be installed directly onto the original drive, introduced through a replacement drive already loaded with malicious code, or deployed through an external device.

Once installed, the malware could be activated through specialized commands. Prosecutors allege the malicious software bypassed ATM security controls and allowed conspirators to issue unauthorized commands to the machine’s cash-dispensing module. Cash would then be released until the ATM was emptied or the operation was interrupted.

The malware also contained a self-deletion function designed to remove evidence after a jackpotting operation was completed. Prosecutors allege the feature was intended to avoid detection during forensic analysis and conceal the presence of the malicious software from financial institutions investigating the compromised machines.

According to the December indictment, the alleged scheme involved 53 FDIC-insured banks and 40 NCUA-insured credit unions. Prosecutors allege that between approximately February 2024 and December 2025, members of the conspiracy committed or attempted at least 63 jackpotting attacks against banks and at least 54 against credit unions.

Federal prosecutors allege losses of at least approximately $5.4 million from those attacks and another approximately $1.43 million in attempted thefts. The government is seeking forfeiture of at least $5,401,181 representing proceeds allegedly traceable to offenses charged in the case.

Individual attacks could produce substantial losses. Prosecutors allege conspirators obtained approximately $300,000 during jackpotting attacks against two ATMs at a credit union in Kearney, Nebraska, on August 16 and 17, 2025.

Other alleged Nebraska operations described in the indictment include approximately $19,000 taken from an ATM in Nebraska City in October 2024, approximately $29,280 obtained from an Omaha credit union ATM in December 2024 and approximately $79,200 obtained from another Omaha ATM in March 2025. Prosecutors also allege conspirators attempted to obtain approximately $199,466 from an ATM in Lincoln in October 2024.

Federal authorities contend the operation extended well beyond Nebraska. The indictment describes alleged activity involving the United States, Venezuela, Colombia, Mexico, Spain, El Salvador, Honduras and other locations. Prosecutors say jackpotting crews traveled in groups, used multiple vehicles and divided responsibilities among reconnaissance teams, individuals installing malware and crews responsible for collecting cash after dispensing commands were issued.

The government alleges the proceeds were divided among participants and transferred through other members or associates in an effort to disguise their source. The money-laundering charge accuses defendants of conducting transactions involving criminal proceeds and moving funds between the United States and foreign locations to conceal the nature, ownership and control of money generated through the alleged scheme.

One defendant, Jimena Romina Araya Navarro, is described by federal authorities as an alleged Tren de Aragua leader. Prosecutors charged Araya Navarro with offenses connected to the jackpotting conspiracy, including allegations that proceeds generated through the operation were tied to support for Tren de Aragua.

The Justice Department alleges that ATM jackpotting proceeds were transferred among Tren de Aragua members and associates and that portions of the money were connected to support for the organization and its activities. The material-support count alleges certain defendants conspired to provide tangible and intangible property, services, lodging, training and personnel knowing and intending that those resources would be used in preparation for or carrying out criminal computer activity charged under federal law.

The earlier October 21 indictment charges 32 defendants across 56 counts, including conspiracy to commit bank fraud, conspiracy to commit bank burglary and computer fraud, 18 counts of bank fraud, 18 counts of bank burglary and 18 counts involving damage to computers.

Federal prosecutors said the defendants face maximum terms of imprisonment ranging from 20 years to as much as 335 years if convicted, depending on the charges against each defendant. Actual sentencing in federal court would depend on the offenses of conviction, federal sentencing law and determinations made by the court.

The District of Nebraska said it had charged 67 alleged Tren de Aragua members and leaders during 2025 across cases involving material support to a designated foreign terrorist organization, bank burglary, money laundering, unauthorized access to protected computers, bank fraud, sex trafficking of minors, assault and related offenses.

The investigation is being conducted through the Homeland Security Task Force initiative, with FBI Omaha and Homeland Security Investigations among the principal investigative agencies. Prosecutors from the U.S. Attorney’s Office for the District of Nebraska, the Justice Department’s Computer Crime and Intellectual Property Section and Joint Task Force Vulcan are handling the case, with assistance from numerous federal, state and local agencies across the country.

FBI Omaha Special Agent in Charge Eugene Kowel said the case centered on an alleged Tren de Aragua plot to deploy sophisticated malware against financial institutions across the United States and siphon millions of dollars from American banks. The investigation also involved FBI field offices in Sacramento, Seattle, Springfield, Miami and Oklahoma, along with the Secret Service, U.S. Marshals Service and numerous state and local agencies.

The case illustrates the convergence of physical burglary, malicious software and financial laundering in modern ATM jackpotting operations. The alleged scheme required access to the machines, malware capable of overriding ATM controls, coordinated crews to extract the cash and a separate network to move and conceal the proceeds.

The federal prosecution remains active. The December indictment represents accusations returned by a grand jury and does not establish guilt against any defendant.

---

---

---

---

U.S. Department of Justice, U.S. Attorney’s Office for the District of Nebraska — United States v. Anibal Alexander Canelon Aguirre, et al., Case No. 8:25-cr-00242-BCB-RCC, Indictment filed December 9, 2025. us_dis_ned_8_25cr242_indictment. (Free Download)

---

---

---

---

---

---

---

---

---

---

🔥 NOW AVAILABLE! 🔥

‎👉 Eclipsera – Apple Music

---

---

---

---

---