Guilty pleas by five Venezuelan nationals
Five Venezuelan nationals — 27-year-old Luis Alberto Velasquez-Artigas, 29-year-oldRoyder Adrian Figuera-Perez, 27-year-old Javier Mejia, Jr, 33-year-old Gabriel Alexjandro Corales-Garcia, 33, and 26-year-old Italo Lizandro Corrales-Carrillo — pleaded guilty to one count of conspiracy to commit bank larceny. The five were arrested in December 2025 after surveillance recorded failed attempts to install ATM malware in two Kansas towns. Velasquez-Artigas has already been sentenced to nine months in prison; the other defendants are awaiting sentencing.
Failed, recorded attempts in Wamego and Manhattan, Kansas
The Justice Department said the arrests followed failed jackpotting attempts in Wamego and Manhattan, Kansas. "The conspirators were unsuccessful in installing the malware on the ATM in Wamego, but their attempts at installing the malware triggered the alarm causing law enforcement to respond, and the culprits didn’t return to the site," the Justice Department added. In Manhattan, the group was "equally unsuccessful in getting the ATM to dispense money." Both attempted thefts were captured by surveillance cameras, and the perpetrators were arrested a few days later.
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleThe malware, the method, and the mechanics of jackpotting
The Justice Department and reporting list the malware families used in recent ATM jackpotting campaigns by name: ATMii, ATMitch, GreenDispenser, Alice, RIPPER, Skimer, SUCEFUL, and Ploutus. According to the description provided, attackers install malware on the ATM's internal computer and then control that machine using an attached USB keyboard or the built-in PIN pad. From there, the malware can issue commands to the internal cash dispenser and empty the money storage cassette.
Wider enforcement activity: FBI warning and Tren de Aragua prosecutions
The FBI warned in February that criminals stole over $20 million last year in a surge of ATM jackpotting incidents. That warning followed a wave of arrests targeting members of the Tren de Aragua Venezuelan criminal organization, which prosecutors say was linked to a massive ATM jackpotting scheme deploying Ploutus malware to steal millions from ATMs across the United States. To date, the Justice Department has charged 87 Tren de Aragua members; those defendants face maximum prison terms ranging from 20 to 335 years each. Separately, South Carolina federal prosecutors announced in January that two Venezuelan nationals convicted of jackpotting attacks will be deported after serving their sentences.
What this means for banks, security teams, and the public
- Banks and other financial institutions: U.S. Attorney Ryan A. Kriegshauser urged banks and financial institutions to invest in technology updates that "help thwart jackpotting," and the office said it is available to answer questions about how to do so. Institutions will be watching both software and physical controls on ATMs given the described method — malware on the internal computer and use of attached USB keyboards or PIN pads to trigger cash dispensers.
- Technologists and security teams: The Blue Report 2026—cited in the source material—offers a reminder about defensive posture: "Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply." The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments, a statistic the source includes when discussing defensive effectiveness.
- The public and ATM users: The FBI’s figure that criminals stole over $20 million last year underlines the real-world cash impact of these campaigns. Surveillance footage from the failed Kansas attempts demonstrates law enforcement can and does respond when alarms are triggered, and that detection can prevent theft even when attackers attempt physical access to ATMs.
The record in this case is concrete: surveillance caught unsuccessful attempts, arrests followed days later, one defendant has been sentenced, and prosecutors continue to pursue broader networks tied to massive thefts. The Justice Department’s push to have financial institutions upgrade protections — paired with law enforcement activity against organized groups such as Tren de Aragua and warnings from the FBI — sets the operational frame for how future jackpotting attempts will be detected and prosecuted. Sentencing for the remaining defendants and whether institutions adopt the technology updates urged by the U.S. Attorney will be immediate, measurable indicators of how the threat landscape changes in response.
