Five Venezuelan nationals pleaded guilty September 1 to conspiracy to commit bank larceny for deploying malware to compromise ATMs in Kansas and empty cash cassettes. The defendants were arrested days after failed installation attempts captured on surveillance cameras in Wamego and Manhattan in December 2025, part of a broader FBI investigation that resulted in charges against 87 Tren de Aragua gang members.
Malware-Controlled Cash Dispenser Commands via USB Keyboard and PIN Pad
The defendants installed malware on ATM internal computers, then used either a USB keyboard or the built-in PIN pad to issue commands to cash dispensers and empty money storage cassettes. This technique — known as ATM jackpotting — bypasses the need to compromise network infrastructure or banking backend systems, instead targeting the physical endpoint where cash is stored.
Luis Alberto Velasquez-Artigas (27), Royder Adrian Figuera-Perez (29), Javier Mejia Jr. (27), Gabriel Alexjandro Corales-Garcia (33), and Italo Lizandro Corrales-Carrillo (26) all entered guilty pleas. Velasquez-Artigas received nine months in prison; the remaining four defendants await sentencing.
The malware installation requires brief physical access to the ATM’s internal computer, which attackers typically gain by opening service panels with universal or compromised keys. Once the malware is loaded, attackers can return later to execute cash dispenser commands without prolonged physical access, reducing the risk of detection during the actual theft.
FBI Disruption of Transnational Venezuelan-Organized Cybercrime Targeting U.S. Financial Infrastructure
The Kansas arrests are part of a broader investigation into Tren de Aragua gang operations. Eighty-seven gang members face charges carrying 20 to 335 year sentences, indicating a sustained law enforcement effort to disrupt Venezuelan-organized cybercrime operations targeting U.S. financial infrastructure.
The December arrests followed failed installation attempts that were captured on surveillance cameras in Kansas. The FBI and U.S. Attorney’s Office for Kansas prosecuted the case, demonstrating the capacity to identify, track, and disrupt transnational ATM malware operations even when attackers operate across borders.
Velasquez-Artigas Sentenced to Nine Months; Four Co-Defendants Await Sentencing
Luis Alberto Velasquez-Artigas received a nine-month prison sentence, while Royder Adrian Figuera-Perez, Javier Mejia Jr., Gabriel Alexjandro Corales-Garcia, and Italo Lizandro Corrales-Carrillo await sentencing. The sentences will establish a baseline for penalties applied to foreign nationals who enter the U.S. to conduct ATM jackpotting operations.
The conspiracy charge recognizes the coordinated nature of the operation, where multiple individuals traveled together to target specific ATM locations in Kansas. The failed installation attempts captured on surveillance provided the evidence needed to link the defendants to the malware deployment operation.
ATM Jackpotting Prosecution Demonstrates Federal Capacity to Dismantle Cross-Border Financial Crime Networks
The successful prosecution marks a shift from treating ATM jackpotting as isolated physical theft to pursuing conspiracy charges that recognize the organized, transnational nature of the attacks. The guilty pleas and sentencing establish a legal precedent for charging foreign nationals who travel to the U.S. specifically to deploy ATM malware.
Financial institutions and ATM operators face ongoing risk from jackpotting attacks that combine physical access with malware. The use of USB keyboards or PIN pads to control compromised ATM computers means that detection requires monitoring for unauthorized software installation and anomalous cash dispenser commands, not just network-level intrusion detection.
The broader Tren de Aragua investigation that resulted in charges against 87 gang members facing sentences up to 335 years signals sustained federal attention to Venezuelan-organized cybercrime operations. The Kansas guilty pleas represent the first completed prosecutions in what appears to be a multi-year, multi-jurisdiction effort to dismantle the gang’s U.S. financial crime infrastructure.
Surveillance footage of the failed ATM jackpotting attempts in Wamego and Manhattan provided law enforcement with evidence linking the defendants to the conspiracy. The FBI’s ability to track and apprehend the group within days of the failed installations demonstrates the effectiveness of physical security measures — cameras, tamper alerts, and physical monitoring — in detecting jackpotting attacks before they succeed.
