Actor Profile

This threat actor is a coordinated group of Venezuelan nationals conducting ATM jackpotting operations targeting financial institutions in the United States. Five members—Luis Alberto Velasquez-Artigas (27), Royder Adrian Figuera-Perez (29), Javier Mejia Jr. (27), Gabriel Alexjandro Corales-Garcia (33), and Italo Lizandro Corrales-Carrillo (26)—pleaded guilty to conspiracy to commit bank larceny. The group's motivation is financially driven, seeking to steal cash directly from ATMs by installing malware on internal ATM computers. Their strategy specifically targeted ATMs believed to be more vulnerable to malware exploitation by design. The group was arrested in December 2025 following failed jackpotting attempts in Wamego and Manhattan, Kansas, captured on surveillance cameras. This group operates within a broader context of Venezuelan criminal activity targeting U.S. ATM infrastructure, though direct links to larger organizations like Tren de Aragua were not established for these specific defendants.

TTPs (Tactics, Techniques, Procedures)

The group's primary TTP involves physical access to ATM hardware to install malware on the internal computer system. Once physical access is achieved, attackers install jackpotting malware that can be controlled via attached USB keyboard or the ATM's built-in PIN pad. The malware issues commands to the internal cash dispenser to empty money storage cassettes. The article references multiple ATM jackpotting malware families used in similar campaigns including ATMii, ATMitch, GreenDispenser, Alice, RIPPER, Skimer, SUCEFUL, and Ploutus, though the specific malware variant used by this group was not disclosed. The group conducted reconnaissance to identify ATMs with design vulnerabilities making them more susceptible to malware installation. Their operational security was poor, with failed installation attempts triggering alarms and surveillance cameras capturing their activities, leading to rapid arrest.

Targets & Patterns

The group exclusively targeted automated teller machines (ATMs) within the United States financial services sector, specifically in Kansas (Wamego and Manhattan). Their target selection was deliberate, focusing on ATMs they assessed as having design vulnerabilities making them more susceptible to malware-based attacks. This targeting pattern suggests the group conducted pre-operational reconnaissance to identify vulnerable ATM models or configurations. The motivation is purely financial—direct theft of cash from ATM money storage cassettes. The choice of targets reflects an understanding that certain ATM models lack adequate security controls against physical tampering and malware installation, representing lower-hanging fruit for financially motivated criminals.

Historical Context

This case is part of a significant surge in ATM jackpotting incidents in the United States. The FBI warned in February 2026 that criminals stole over $20 million in the previous year through ATM jackpotting attacks. This warning followed a wave of arrests targeting members of the Tren de Aragua Venezuelan criminal organization linked to a massive ATM jackpotting scheme deploying Ploutus malware to steal millions across the U.S. The Justice Department has charged 87 Tren de Aragua members in related cases, with maximum prison terms ranging from 20 to 335 years each. In January 2026, two other Venezuelan nationals convicted of jackpotting attacks were sentenced to deportation after serving prison terms. While this specific five-member group's direct connection to Tren de Aragua is not stated, their nationality and operational methods align with a broader pattern of Venezuelan criminal networks exploiting U.S. ATM infrastructure vulnerabilities during 2025-2026.

Defensive Recommendations

  • Implement physical security controls on ATM hardware including tamper-evident seals, intrusion detection sensors, and alarm systems that trigger upon unauthorized access to internal components
  • Deploy ATM security software updates and endpoint protection solutions specifically designed to detect and block jackpotting malware families (ATMii, ATMitch, GreenDispenser, Alice, RIPPER, Skimer, SUCEFUL, Ploutus)
  • Establish continuous video surveillance monitoring of ATM locations with real-time alerting capabilities to detect suspicious physical access attempts
  • Implement application whitelisting and USB port controls on ATM internal computers to prevent unauthorized software installation and external device connections
  • Conduct regular security assessments of ATM models to identify design vulnerabilities and prioritize hardware upgrades for models known to be susceptible to malware-based attacks

---

# Geopolitical Context

Geopolitical Context

The prosecution of five Venezuelan nationals for ATM jackpotting attacks reflects a broader pattern of transnational cybercrime emanating from Venezuela amid the country's prolonged economic and political crisis. The case appears linked to a wider law enforcement effort targeting the Tren de Aragua criminal organization, which the Justice Department has connected to a systematic ATM jackpotting scheme that stole over $20 million in 2025. This represents not merely isolated criminal activity but an organized campaign exploiting financial infrastructure vulnerabilities across multiple US states. The defendants' targeting of ATMs perceived as "more vulnerable to malware" suggests operational planning and technical reconnaissance. While these actors operate as criminal enterprises rather than state-directed entities, their activities occur against the backdrop of Venezuela's governance challenges and limited bilateral law enforcement cooperation between Caracas and Washington, creating permissive conditions for such groups to organize and operate with relative impunity before crossing international borders.

State Actor Alignment

The perpetrators are Venezuelan nationals operating as part of organized criminal networks rather than state-sponsored actors. However, their activities are consistent with patterns observed when weak governance, economic collapse, and limited rule of law create environments conducive to transnational criminal enterprises. The Justice Department's charging of 87 members of the Tren de Aragua organization—a Venezuelan criminal group—indicates systematic criminal infrastructure that may benefit indirectly from Venezuela's institutional weaknesses. US authorities have responded through criminal prosecution and deportation measures, with two convicted individuals slated for removal after serving sentences. The FBI's February 2026 warning about $20 million in losses underscores the scale of the threat and suggests heightened US law enforcement prioritization. There is no indication of Venezuelan state sponsorship or direction of these activities; rather, the pattern suggests criminal opportunism exploiting both domestic instability in Venezuela and cross-border mobility to target US financial infrastructure.

Business Impacty pro region

For North America, this case highlights persistent vulnerabilities in legacy ATM infrastructure and the challenge of defending widely distributed financial endpoints against physical-access attacks. The US Attorney's public encouragement for financial institutions to invest in anti-jackpotting technology indicates recognition that defensive measures remain inconsistent across the sector. The geographic spread of attacks—from Kansas to multiple states—demonstrates that even mid-sized markets face exposure to sophisticated transnational criminal operations. For Latin America, the case reinforces concerns about Venezuelan criminal networks' regional reach and their increasing technical sophistication in cyber-enabled financial crime. The pattern of arrests, prosecutions, and deportations may influence migration enforcement policies and bilateral security cooperation frameworks. European financial institutions operating ATM networks should note the malware families cited (ATMii, Ploutus, RIPPER, and others) as indicators of techniques that may migrate across regions as criminal groups adapt to enforcement pressure in North America.

Forecast

If US law enforcement continues aggressive prosecution of Tren de Aragua and associated networks, criminal groups may adapt by shifting to alternative cash-out methods or targeting jurisdictions with less robust ATM security standards. If financial institutions accelerate deployment of anti-jackpotting technologies in response to the FBI's warnings and prosecutorial guidance, attackers are likely to focus on legacy systems in smaller markets or shift toward logical attacks that do not require physical access. If Venezuela's economic and governance challenges persist without improvement, the country is likely to remain a source region for technically capable criminal actors seeking opportunities abroad. If deportation becomes standard practice following conviction, some deterrent effect may emerge, though the high potential payoffs from successful attacks—evidenced by the $20 million stolen in 2025—suggest financial incentives will continue to drive recruitment. Regional cooperation on financial crime intelligence sharing between US and Latin American partners may prove critical to disrupting recruitment and operational planning before groups deploy internationally.