5 Venezuelans Guilty as ATM Jackpotting Tops 1,900 Incidents Since 2020

For threat intelligence and financial-sector security teams, the guilty pleas offer a rare evidence-based look at ATM jackpotting tradecraft: physical access via ATM internal computers, malware families like Ploutus and Skimer, and command of cash dispensers through USB keyboards or PIN pads. The FBI's count of 700 incidents in 2025 alone — over $20 million in losses — shows this is not a marginal attack vector. This case provides both a baseline for detection and a reminder that basic physical alarms and surveillance can stop even coordinated jackpotting crews.

Five Venezuelan nationals have pleaded guilty in a US court to conspiracy to commit bank larceny in connection with attempted ATM jackpotting attacks in Kansas, underscoring a sharp escalation in a blended physical-cyber crime wave that the FBI says has caused more than $20 million in losses in 2025 alone. The defendants — Luis Alberto Velasquez-Artigas, 27; Royder Adrian Figuera-Perez, 29; Javier Mejia Jr., 27; Gabriel Alexjandro Corales-Garcia, 33; and Italo Lizandro Corrales-Carrillo, 26 — traveled from Indiana to Wamego and Manhattan, Kansas, in December 2025 to install malware on ATMs and remotely trigger them to dispense cash. Both attempts failed and were captured by surveillance cameras, leading to their arrests days later. Velasquez-Artigas has since been sentenced to nine months in prison, while the other four await sentencing. The guilty pleas, announced in a Department of Justice press release, provide a rare window into how ATM jackpotting crews operate and the legal consequences they face.

“

The malware families cited across multiple jackpotting investigations include ATMii, ATMitch, GreenDispenser, Alice, RIPPER, Skimer, SUCEFUL, and Ploutus.

The broader threat context is significant. In February 2026, the FBI warned that ATM jackpotting incidents are increasing across the United States. Since 2020, more than 1,900 such incidents have been recorded, with over 700 of them — causing more than $20 million in losses — occurring in 2025 alone. That trajectory suggests the problem is accelerating rather than stabilizing, even as law enforcement and financial institutions deploy countermeasures. The Kansas case shows both the vulnerability and the resilience of current defenses. In Wamego, the malware installation attempt triggered an alarm, prompting law enforcement to respond, and the group did not return to the site. In Manhattan, the group was equally unsuccessful in getting the ATM to dispense money. Yet the fact that the defendants were able to access ATM internal computers and make the attempt at all points to remaining security gaps.

ATM jackpotting is a distinctive form of cyber-enabled physical theft. Criminals typically gain physical access to an ATM's internal computer, then install malware by connecting a USB keyboard or using the built-in PIN pad to issue commands to the cash dispenser and empty the money storage cassette. The malware families cited across multiple jackpotting investigations include ATMii, ATMitch, GreenDispenser, Alice, RIPPER, Skimer, SUCEFUL, and Ploutus. Each family represents a different toolset and command-and-control approach, but all exploit the same fundamental weakness: once an attacker has physical access, the logical controls of the ATM can be bypassed or manipulated. This is not a purely remote cyberattack; it requires on-site presence, reconnaissance, and coordination, which makes it both harder to detect before the attempt and easier to investigate afterward through physical evidence and surveillance.

The case also highlights how law enforcement is framing ATM jackpotting as a national organized crime priority. FBI Kansas City Special Agent in Charge Chris Ormerod called jackpotting a growing trend seen nationwide. U.S. Attorney Ryan A. Kriegshauser described the defendants as "jackpotting bandits" who specifically targeted ATMs they believed were more vulnerable to malware by design. His call for banks and financial institutions to invest in technology updates reflects a clear expectation that private-sector security improvements are essential to reducing the attack surface. The sentencing disparity is also notable. Velasquez-Artigas received nine months for his role in the failed Kansas attempts, while in late August 2026, 27-year-old Juan Manuel Gouveia-Aguilera was sentenced to 96 months in prison and five years of supervised release for his involvement in an ATM jackpotting scheme. That contrast suggests courts are weighing factors such as prior involvement, scale, and the success of the conspiracy when deciding sentences.