U.S. authorities have announced the deportation of two Venezuelan nationals convicted of stealing hundreds of thousands of dollars from American banks by hacking ATMs with malware.
The move brings an end to a multi-state ATM “jackpotting” scheme that used malware to target older model Automated Teller Machines (ATM), forcing them to dispense all available cash.
Luz Granados, 34, and Johan Gonzalez-Jimenez, 40, pleaded guilty to conspiracy and computer-related crimes after investigators linked them to a series of ATM break-ins across the southeastern United States that led to the theft of hundreds of thousands of dollars.
Targeting Older ATMs After Business Hours
According to federal prosecutors, the pair focused on older-model ATMs in Rock Hill, Columbia, Georgia, North Carolina, and Virginia. Investigators said the attacks typically took place at night, after business hours, when the machines were less likely to be monitored.
Granados and Gonzalez-Jimenez would remove the ATM’s outer casing and connect a laptop or external device to the internal system. From there, they installed malware that bypassed built-in security controls and allowed them to control the cash-dispensing mechanism.
“The defendants would approach an ATM at nighttime and remove the outer casing of the machine and then connect a laptop computer to install malware which overcame the ATM’s security protocols,” the Justice Department said in a press release.
Malware Forced Machines To Empty Cash
Once activated, the software instructed the ATMs to release cash until they were empty. Authorities emphasized that customer bank accounts were not affected, as the stolen money came directly from the banks that owned the ATMs, not individual customer accounts.
Prosecutors said the malware used in the attacks relied on variants of Ploutus malware, which can be installed by connecting external devices like laptops or thumb drives, or by swapping out an ATM’s hard drive with one that is already infected. Once deployed, the malware can both force unauthorized cash withdrawals and erase evidence to make detection more difficult for bank employees.
Sentences And Financial Penalties
U.S. District Judge Mary Geiger Lewis sentenced Gonzalez-Jimenez to 18 months in federal prison and ordered him to pay $285,100 in restitution. He will be deported once his prison term is complete.
Further, Granados was sentenced to time served, and she remains in federal custody while awaiting deportation. She was also ordered to pay $126,340 in restitution.
The South Carolina case was investigated by the U.S. Secret Service, the South Carolina Law Enforcement Division’s Computer Crime Center, and local police departments in Rock Hill and West Columbia. Assistant U.S. Attorney Scott Matthews prosecuted the case.
Links To Larger Criminal Network
Prosecutors said evidence from the South Carolina investigation was later shared with authorities in Nebraska, helping trigger a much larger case. A federal grand jury there indicted 54 individuals connected to a similar ATM jackpotting conspiracy that allegedly stole millions of dollars across the country.
That broader case also names Jimena Romina Araya Navarro, an alleged Tren de Aragua leader and Venezuelan entertainer identified by prosecutors as one of the alleged leaders of the Venezuelan gang Tren de Aragua. She was sanctioned by the U.S. Department of the Treasury’s Office of Foreign Assets Control (OFAC) in December.
Ongoing Enforcement Efforts
Last month, the Justice Department announced that five additional Venezuelan nationals involved in similar ATM jackpotting schemes across multiple states are also facing immediate deportation after pleading guilty or being sentenced.
Federal officials say the prosecutions underscore that while ATM jackpotting is not a new tactic, it remains a serious threat when criminals gain physical access to outdated financial infrastructure — and that authorities are increasingly targeting both the crimes and the organized criminal networks behind them.
