DOJ says the defendants helped deploy Ploutus malware to compromise ATMs nationwide and force cash dispensing. The case also alleges connections to Tren de Aragua and includes restitution to victim banks.

U.S. prosecutors announced that two defendants were sentenced in an international ATM “jackpotting” conspiracy, centered on malware identified as Ploutus. DOJ alleges the defendants played a role in deploying malicious tools that allowed attackers to force ATMs across the United States to dispense cash. Prosecutors characterized the conduct as an attack against bank systems and consumer finances, emphasizing the criminal use of technology to manipulate ATM operations. The press release further links the conspiracy to Tren de Aragua, a reference that prosecutors use to explain investigative context and alleged criminal connections. In addition to the prison terms, DOJ highlighted restitution to victim banks, signaling both the scale of the harm and the government’s attempt to recover losses tied to the attacks. “Jackpotting” cases are typically distinguished from ordinary ATM skimming because the focus is on malware-based intrusion and control—often requiring technical expertise, malware distribution, and coordination with other actors. For consumers, these crimes can translate into account disruption, bank reimbursement processes, and wider security responses. The DOJ action underscores that ATM malware and forced-cash dispensing schemes are treated as serious federal cyber-enabled fraud and theft.