# Five Venezuelan Nationals Plead Guilty in Failed Kansas ATM Jackpotting Plot

> Five Venezuelan nationals — Luis Alberto Velasquez-Artigas, Royder Adrian Figuera-Perez, Javier Mejia Jr., Gabriel Alexjandro Corales-Garcia, and Italo Lizandro Corrales-Carrillo — pleaded guilty to conspiracy to commit bank larceny after driving from Indiana to Kansas in December 2025 to install jackpotting malware on ATMs in Wamego and Manhattan, intending to remotely trigger cash dispensing. Both attempts failed and surveillance footage led to the group's arrest; Velasquez-Artigas was sentenced to nine months, with the other four awaiting sentencing.

- **Published:** 2026-08-31T00:00:00Z
- **Last reviewed:** 2026-08-31T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2275
- **ID:** TL-2026-2275
- **Severity:** LOW
- **Category:** MALWARE
- **Status:** RESOLVED
- **Detections:** 9 · **IOCs:** 20 (full data via the Threadlinqs MCP server — Purple tier)

## Description

In December 2025, five Venezuelan nationals traveled from Indiana to Kansas with the intent to commit ATM "jackpotting" — physically installing malware on an ATM's internal hardware and then remotely issuing a command to force the machine to dispense cash without a legitimate card transaction. U.S. Attorney Ryan A. Kriegshauser stated the group "specifically target[ed] ATMs they thought were by design more vulnerable to malware." The plan called for one conspirator to physically install the malicious code on the targeted machine while the group later activated a remote command to collect the dispensed cash. Both attempts in this case failed: the installation attempt in Wamego, Kansas tripped the ATM's alarm and caused law enforcement to respond, forcing the group to abandon the site, and the attempt in Manhattan, Kansas never produced dispensed cash. Surveillance cameras captured both incidents, and the five defendants were arrested within days. All five subsequently pleaded guilty to one count of conspiracy to commit bank larceny; Luis Alberto Velasquez-Artigas was sentenced to nine months in prison, while Royder Adrian Figuera-Perez, Javier Mejia Jr., Gabriel Alexjandro Corales-Garcia, and Italo Lizandro Corrales-Carrillo await sentencing. The DOJ announced the guilty pleas on August 31, 2026.

Neither the specific malware family nor any network indicators were disclosed for this incident by prosecutors or reporting outlets, and no cash was ever successfully dispensed. The case is nonetheless one instance of a technique class the FBI has flagged as a fast-growing nationwide problem: an FBI/IC3 FLASH alert (CSA-260219, issued February 19, 2026) reported 1,900 ATM jackpotting incidents since 2020, including more than 700 incidents in 2025 alone causing over $20 million in losses. That alert describes attackers gaining physical entry by "opening an ATM face with widely available generic keys," then either removing the ATM's internal hard drive to copy malware onto it externally before reinstalling it, or swapping in a drive pre-loaded with malware, and rebooting the machine. The malware is designed to "interact directly with the ATM hardware," issuing its own commands to the eXtensions for Financial Services (XFS) middleware layer so it can bypass bank transaction-authorization software entirely and instruct the dispenser to release cash on demand. The alert names Ploutus — first observed in Mexico in 2013 and described by Google-affiliated researchers as one of the most advanced ATM malware families — as a key driver of the broader trend.

Independent technical reporting on the Ploutus family (which the FBI ties to this technique class, though it is not confirmed as the specific malware recovered in the Wamego/Manhattan attempts) documents further tradecraft relevant to the broader campaign this Kansas case belongs to: the malware is commonly packed with the commercial .NET Reactor obfuscator, applying string encryption, function-name obfuscation, method proxying, control-flow-graph obfuscation, and method-body encryption ("Necrobit") that swaps in real method bodies only at JIT-compile time to defeat static and debugger-based analysis; operators activate the malware's hidden menu locally (in one documented variant, by tapping each corner of the touchscreen five times) and issue jackpotting commands via an attached external keyboard or the ATM's own function keys using activation sequences such as "F8F1F2F3F4," while displaying a fake maintenance message on screen to mask the activity from onlookers. A related, separately prosecuted and much larger campaign — two federal indictments (October 21 and December 9, 2025) in the District of Nebraska charging 54 members of Tren de Aragua (TdA), a Venezuelan transnational criminal organization designated a Foreign Terrorist Organization by the U.S. State Department — used a Ploutus variant against the Kalignite multivendor ATM platform (targeting Diebold Nixdorf and other hardware) and is documented as gaining cabinet access via lockpicking or master/duplicate keys, deploying the payload via a pre-infected hard drive or USB device, requiring a unique 24-hour activation code entered per machine, achieving persistence by rewriting the `HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit` registry value, and then deleting logs and terminating security-monitoring processes to cover its tracks; that reporting also documents specific artifacts (filenames `AgilisConfigurationUtility.exe` and `Diebold.exe`, service name `DIEBOLDP`, and MD5 hashes `C04A7CB926CCBF829D0A36A91EBF91BD` and `5AF1F92832378772A7E3B07A0CAD4FC5`) and losses exceeding $40 million across 1,500+ confirmed ATM attacks since 2021. Public reporting on the Wamego/Manhattan case does not name a criminal organization or attribute the five Kansas defendants to Tren de Aragua or to any other named group; the two cases share nationality of defendants, general technique (physical malware installation plus a remotely/locally triggered dispense command), and rough timing, but no source establishes a direct organizational or technical link between them, and none of the file/registry/hash artifacts above are confirmed present in the Kansas incident.

## MITRE ATT&CK

- T1091 Replication Through Removable Media
- T1106 Native API
- T1547.004 Boot or Logon Autostart Execution: Winlogon Helper DLL
- T1685 Disable or Modify Tools
- T1027 Obfuscated Files or Information
- T1140 Deobfuscate/Decode Files or Information
- T1036 Masquerading
- T1082 System Information Discovery
- T1657 Financial Theft

## Sources

- [Hackers Plead Guilty to ATM Jackpotting Attacks](https://cybersecuritynews.com/hackers-plead-guilty-to-atm-jackpotting-attacks/)
- [Five plead guilty in latest federal ATM jackpotting case](https://therecord.media/kansas-atm-jackpotting-guilty-pleas)
- [FBI investigation leads five Venezuelan nationals to plead guilty to attempting to jackpot Kansas ATMs](https://www.justice.gov/usao-ks/pr/fbi-investigation-leads-five-venezuelan-nationals-plead-guilty-attempting-jackpot-kansas)
- [Five Venezuelan Nationals Plead Guilty in Kansas ATM Jackpotting Attempt](https://securityaffairs.com/198233/cyber-crime/five-venezuelan-nationals-plead-guilty-in-kansas-atm-jackpotting-attempt.html)
- [Five Venezuelan Nationals Plead Guilty After Kansas ATM Jackpotting Attempts, FBI Reports 1,900 US Incidents Since 2020](https://www.technadu.com/five-venezuelan-nationals-plead-guilty-after-kansas-atm-jackpotting-attempts-fbi-reports-1900-us-incidents-since-2020/634532/)
- [Group pleads guilty after failed ATM 'jackpotting' scheme in Kansas](https://www.wibw.com/2026/08/31/group-pleads-guilty-after-failed-atm-jackpotting-scheme-kansas/)
- [Five men plead guilty in Kansas ATM 'jackpotting' plot](https://www.ksn.com/news/crime/five-men-plead-guilty-in-kansas-atm-jackpotting-plot/)
- [Federal Charges in ATM 'Jackpotting' Case](https://www.ksal.com/156131-2/)
- [Five Plead Guilty to Using ATM Jackpotting Malware in Cash Theft](https://gbhackers.com/five-plead-guilty-to-using-atm-jackpotting-malware/)
- [FBI Reports 1,900 ATM Jackpotting Incidents Since 2020, $20M Lost in 2025](https://thehackernews.com/2026/02/fbi-reports-1900-atm-jackpotting.html)
- [FBI/IC3 CSA-260219: Increase in Malware Enabled ATM Jackpotting Incidents](https://www.ic3.gov/CSA/2026/260219.pdf)
- [U.S. DOJ Charges 54 in ATM Jackpotting Scheme Using Ploutus Malware](https://thehackernews.com/2025/12/us-doj-charges-54-in-atm-jackpotting.html)
- [Tren de Aragua ATM Jackpotting: Ploutus Malware Exploits Kalignite Platform in $40M US Attack](https://www.rescana.com/post/tren-de-aragua-atm-jackpotting-ploutus-malware-exploits-kalignite-platform-in-40m-us-attack)
- [Ploutus (ATM malware profile)](https://www.cyber.nj.gov/threat-landscape/malware/atm-malware/ploutus)
- [Automated Deobfuscation of Ploutus ATM Malware](https://www.crowdstrike.com/en-us/blog/ploutus-atm-malware-deobfuscation-case-study/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2275