Five jackpotting guilty pleas describe a crew that shopped for ATM models it could infect
Prosecutors in Kansas say the group crossed state lines to reach ATMs it believed were architecturally softer, which makes the machine on the street the control that mattered. The FBI counts 700 such incidents in 2025.
The Watch · Security desk
What happened
- Five Venezuelan nationals pleaded guilty to conspiracy to commit bank larceny over what prosecutors describe as a group dedicated to emptying ATMs with malware.
- The FBI says it has tracked more than 1,900 jackpotting incidents since 2020, including over 700 in 2025 that involved more than $20 million in losses.
- In the related Ploutus prosecution, Juan Manuel Gouveia-Aguilera was sentenced in Omaha on August 20 to eight years over more than $3.5 million in ATM losses.
Why it matters
- Who has to decide decision If crews are choosing machines by architecture, the purchasing and refresh decision sets the exposure, and a monitoring contract added after purchase will not offset that exposure.
- Who's exposed exposure A crew willing to drive between states means the weakest model anywhere in an estate is exposed, and the charges span ATMs in 47 states.
- What it costs cost About $28,600 of expected loss per successful hit is the number a retrofit quote has to beat per machine, which sets a hard ceiling on what hardening can justify.
- What doesn't add up contradiction Federal officials name a Ploutus author that vendors who tracked the family for a decade will not confirm, so the tooling remains active despite the pleas.
Next story · Security · 3d ago
Prosecutors say an OpenAI engineer left an encrypted recorder in a conference room TV's USB portConfirmed13 publishers
The mechanism sits inside the cabinet. Court records in the Ploutus cases describe operators cabling a laptop to the ATM's hard drive, or pulling the drive and inserting one already loaded with the malware [11]. Everything after that is a dispense command.
The crew chose targets by model, not by proximity. U.S. Attorney Ryan Kriegshauser said this group specifically targeted ATMs it thought were by design more vulnerable to malware [7], and the December 2025 run fits that: the men drove from Indiana to Kansas to reach machines in Wamego and Manhattan [3]. The driving was overhead against a target list defined by model. Kriegshauser also said technology now exists that can stop jackpotting, and urged companies to invest in it [8].
In Kansas the crew got nothing. Both installs failed and set off police alarms, surveillance cameras caught the group, and arrests followed days later [4]. The alarms went off, but only after the attempt was already underway.
Volume is where the travelling business model shows. The FBI has tracked more than 1,900 jackpotting incidents since 2020, of which more than 700 fell in 2025 and involved over $20m in losses [6]. That is roughly 37% of the six-year incident count inside one year [13]. FBI director Kash Patel put cumulative losses above $58m since 2021 [5], so 2025 carried about a third of the money [14]. Divide $20m by 700 and the average successful hit is near $28,600 [15], a per-machine figure a fleet owner can hold against a retrofit quote.
Sentences so far track physical outcomes rather than ambition. Velasquez-Artigas, 27, received nine months for a run that emptied no machines, while his four co-defendants await sentencing [2]. Juan Manuel Gouveia-Aguilera, tied by prosecutors to more than $3.5m in ATM losses, was sentenced in Omaha on August 20 to eight years plus five years of supervised release and restitution [9], one defendant accounting for about 6% of the national loss total [16]. Oddry Arnoldo Cabrera Torrealba and Carlos Javier Padron drew 6.5 years each, at least 119 people have been charged, and the group allegedly hit ATMs in 47 states and several other countries [10].
The tooling is older than this network. Symantec detected Ploutus in 2013 against ATMs in Mexico, where operators emptied machines using an attached external keyboard or an SMS message, and Google has called it one of the most advanced ATM malware families it has seen [12]. Prosecutors say the proceeds funded violent transnational groups including Tren de Aragua, and that this group created Ploutus [17]. FBI officials told Recorded Future News they believe Anibal Alexander Canelon Aguirre wrote it [18], but companies that have tracked the family for more than a decade told the same outlet they could not confirm that [19]. The guilty pleas remove the drivers who executed these attacks, but the malware code and the target list of vulnerable ATM models remain in use.
What to watch
- Sentencing for Figuera-Perez, Mejia, Corales-Garcia and Corrales-Carrillo, and whether their terms track the nine months given for a run that emptied nothing.
- Whether the FBI's 2026 incident count stays above the 700 logged in 2025 or falls after this wave of guilty pleas.
- Whether any indictment, trial record or vendor report substantiates the FBI's belief that Anibal Alexander Canelon Aguirre wrote Ploutus.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence70
- Adoption
- Not scored
- Hype gap+20
- Incentives50
- Confidence65
Perspective Coverage
4 publishers- Builder
- Builder 29%
- Operator
- Operator 54%
- Investor
- Investor 17%
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
Five Venezuelan nationals pleaded guilty to conspiracy to commit bank larceny after prosecutors accused them of being part of a group dedicated to robbing ATMs using malware.
- [2]
A Kansas federal court sentenced Luis Alberto Velasquez-Artigas, 27, to nine months in prison; the other four defendants, Royder Adrian Figuera-Perez, 29, Javier Mejia Jr, 27, Gabriel Alexjandro Corales-Garcia, 33, and Italo Lizandro Corrales-Carrillo, 26, are awaiting sentencing.
- [3]
According to court documents, the men drove from Indiana to Kansas in December 2025 to rob several ATMs in Wamego and Manhattan through jackpotting, in which criminals break into an ATM and install malware that lets them empty it.
- [4]
Both attempted malware installations in Wamego and Manhattan failed and triggered police alarms; the group was caught on surveillance cameras and all were arrested days later.
- [5]
FBI director Kash Patel said in a statement last week that the ATM jackpotting scheme has caused losses of over $58 million since 2021.
- [6]
The FBI said it has tracked more than 1,900 ATM jackpotting incidents since 2020, and over 700 in 2025 that involved more than $20 million in losses.
- [7]
U.S. Attorney Ryan Kriegshauser said Monday that jackpotting bandits are sweeping the nation and that this group's strategy was to specifically target ATMs they thought were by design more vulnerable to malware.
- [8]
Kriegshauser said there is now technology that can help stop jackpotting attacks and urged companies to invest in it as soon as possible.
- [9]
Juan Manuel Gouveia-Aguilera, 27, was sentenced on August 20 in Omaha, Nebraska, to eight years in prison plus five years of supervised release and restitution to affected banks; prosecutors said he was responsible for more than $3.5 million in ATM losses and was one of several gang members using Ploutus malware to steal from hundreds of ATMs.
- [10]
Oddry Arnoldo Cabrera Torrealba and Carlos Javier Padron were recently given 6.5-year sentences; at least 119 people have been charged, and the group allegedly targeted ATMs in 47 U.S. states and several other countries.
- [11]
In many cases the criminals either link a laptop to the ATM's hard drive or replace it with an infected drive pre-loaded with the Ploutus malware.
- [12]
Ploutus was first detected by Symantec in 2013 and initially deployed against ATMs across Mexico that year, letting criminals empty machines using an external keyboard attached to the ATM or an SMS message; Google researchers have called it one of the most advanced ATM malware families they have seen.
- [13]
The more than 700 incidents in 2025 represent roughly 37% of the more than 1,900 jackpotting incidents the FBI has tracked since 2020.
- [14]
The more than $20 million lost in 2025 is about 34% of the more than $58 million in losses the FBI attributes to the scheme since 2021.
- [15]
Average loss per tracked 2025 jackpotting incident is about $28,600.
- [16]
The more than $3.5 million in losses prosecutors attribute to Gouveia-Aguilera is about 6% of the $58 million total.
- [17]
Assistant Attorney General A. Tysen Duva said the ATM jackpotting schemes were meant to help fund violent transnational criminal organizations such as the Venezuelan gang Tren de Aragua, and the initial indictment accused the group of creating Ploutus.
- [18]
FBI officials previously told Recorded Future News that they believe the Ploutus malware was created by Anibal Alexander Canelon Aguirre, who was named in the indictment that included Gouveia-Aguilera.
- [19]
Recorded Future News spoke to multiple companies that have tracked Ploutus for more than a decade and none could confirm whether Aguirre was the true developer.
Sources
4 independent publishers whose own reporting we read for this story.
- bleepingcomputer.comFive Venezuelans plead guilty to ATM jackpotting attacks in US
1 article · September 1, 2026
- securityaffairs.comFive Venezuelan Nationals Plead Guilty in Kansas ATM Jackpotting Attempt
1 article · September 1, 2026
- securityweek.comFive Venezuelans Plead Guilty in US Court to ATM Jackpotting
1 article · September 1, 2026
- therecord.mediaFive plead guilty in latest federal ATM jackpotting case
1 article · August 31, 2026