Tren de Aragua Jackpotting Attacks: A Case Analysis of the Cartel-Linked Malware Attacks at Financial Institutions Across the U.S.

Authors

• Mackenzie Harms Wickersham, University of Nebraska at OmahaFollow
• Erin M. Kearns, University of Nebraska at OmahaFollow
• Austin C. Doctor, University of Nebraska at OmahaFollow

Document Type

Report

Publication Date

5-2026

Abstract

Four federal indictments filed in the District Court of Nebraska between August 2025 and February 2026 charge 93 members and associates of Tren de Aragua (TdA) for their role in a financial conspiracy that resulted in over $6.1 million in loss at financial institutions across the U.S. since January of 2025. Related indictments filed in Colorado, Massachusetts, New Mexico, New York, and Texas charge at least fifteen other individuals and leaders as part of the multi-state investigation that uncovered the financial fraud scheme.

According to the indictments, a large cell of TdA members in the U.S. operating as part of the broader criminal enterprise used a tactic called “jackpotting” that exploits vulnerabilities in Automated Teller Machines (ATMs) to illegally dispense cash without authorization. The malware used in the TdA jackpotting attacks provided attackers with direct control over the ATM that can be enacted remotely, making early detection and law enforcement intervention difficult.

Accessibility Statement

PDF passed Adobe Accessibility Checker prior to upload. 

Recommended Citation

Harms Wickersham, Mackenzie; Kearns, Erin M.; and Doctor, Austin C., "Tren de Aragua Jackpotting Attacks: A Case Analysis of the Cartel-Linked Malware Attacks at Financial Institutions Across the U.S." (2026). Reports, Projects, and Research. 181.
https://digitalcommons.unomaha.edu/ncitereportsresearch/181