Carlos Javier Padron, 36, an illegal alien from Venezuela, was sentenced yesterday to 78 months in prison for his role in a conspiracy to deploy malware and steal millions of dollars from ATMs in the United States, a crime commonly referred to as “ATM jackpotting.” His co-defendant, Oddry Arnoldo Cabrera Torrealba, also known as “Luis Alejandro Berdugo Barraza,” 37, an illegal alien from Venezuela, was sentenced on June 11, to 78 months in prison for similar conduct.
“Carlos Javier Padron and Oddry Arnoldo Cabrera Torrealba helped deploy sophisticated malware as part of a transnational criminal network that hacked ATMs across the United States and stole millions of dollars through a technique known as ATM jackpotting – which caused bank ATMs to dispense the cash inside of them,” said Assistant Attorney General A. Tysen Duva of the Justice Department’s Criminal Division. “Crimes like this undermine the security of our financial institutions and fuel the operations of violent transnational criminal organizations such as Tren de Aragua (TdA). This sweeping investigation with the District of Nebraska and our law enforcement partners has disrupted this network at all levels. We will protect our financial institutions from technology enabled fraud.”
“ATM jackpotting is TdA’s business plan and their assessed primary source of revenue to fund their terrorist activities that range from reprehensible forms of human trafficking to armed robbery, murder, and the general undermining of America’s national security by flooding our communities with controlled substances,” said U.S. Attorney Lesley Woods for the District of Nebraska. “We will use these prosecutions to put a chokehold on their funding pipeline.”
“TdA is a violent terrorist organization relying on a range of criminal activities to generate revenue supporting their campaigns of violence and terror,” said Special Agent in Charge Euguene Cowel of the FBI Omaha Field Office. “As criminal enterprises change tactics, we surge resources and adapt accordingly to protect the American people. FBI Omaha will continue standing shoulder to shoulder with our local, state, and federal partners in the fight to dismantle and disrupt the activities of TdA locally and globally.”
“These individuals participated in a crime that was both an attack on the American financial system, and an effort by Tren De Aragua to fund even more terror in our country,” said Acting Special Agent in Charge Rick Sabatini of U.S. Immigration and Customs Enforcement Homeland Security Investigations (HSI) Kansas City. “I’m proud of our agents and partners for working tirelessly to pursue justice and put consumers at ease, knowing their bank’s health is sound and not at risk of being damaged by violent, dangerous criminals.”
According to court documents, Padron and Torrealba were part of a sophisticated criminal network responsible for ATM jackpottings throughout the United States. The members of the network conspired to develop and deploy a variant of malware known as Ploutus, which was deployed on ATMs and used to permit the unauthorized withdrawal of currency. The conspiracy relied on individuals including Padron and Torrealba to deploy the Ploutus malware onto ATMs in person. Once installed and activated, the malware permitted the co-conspirators to issue commands to the cash dispensing module of the ATM in order to force unauthorized withdrawals of currency. The Ploutus malware also was designed to delete evidence of its existence to prevent financial institutions from detecting its use on ATMs. Padron and Torrealba were arrested by the Lincoln, Nebraska Police Department at the site of a jackpotting in October 2024.
Padron and Torrealba both pleaded guilty to one count of conspiracy to commit bank burglary and one count of computer fraud and intentional damage to a protected computer. At their respective sentencings, the Court also ordered both Padron and Torrealba to jointly pay $1,537,696 in restitution to the multiple victim banks.
Following the arrest of Padron and Torrealba, a comprehensive federal investigation identified a network of co-conspirators throughout the United States and abroad. Since the arrests of Padron and Torrealba, 96 other defendants have been indicted for their roles in this conspiracy for related offenses including material support to a designated foreign terror organization, bank burglary, money laundering, damage and unauthorized access to protected computers, bank fraud, and conspiracy to commit the same offenses.
The investigation has established extensive direct and indirect links between the indicted co-conspirators and TdA. According to court documents, TdA is a violent transnational criminal organization that originated as a prison gang in Venezuela in the mid-2000s. TdA has expanded its criminal network throughout the Western Hemisphere and established a presence in the United States. TdA’s criminal activities range from drug trafficking and firearms trafficking to commercial sex trafficking, kidnapping, robbery, theft, fraud, and extortion. TdA members also commit murder, assault, and other violent acts to advance the organization’s criminal activities. TdA has also developed an additional source of revenue stream through financial crimes that target financial institutions throughout the United States, including using ATM jackpotting to steal millions of dollars in cash.
FBI’s Omaha Field Office and HSI Omaha are investigating the case, with assistance from FBI’s Denver, Houston, Miami, New Orleans, Oklahoma, Sacramento, Seattle, and Springfield Field Offices, and the United States Secret Service, U.S. Marshals Service (USMS), Customs and Border Protection, U.S. Border Patrol, U.S. Citizenship and Immigration Services, Federal Housing Finance Agency Office of the Inspector General, Financial Deposit Insurance Corporation, Adams County Sheriff’s Office, Appanoose County Sheriff’s Office, Bates County Sheriff’s Office, Sheridan Police Department, Lake County Sheriff’s Office, Leesburg Police Department, Sterling Heights Police Department, Kearney Police Department, Warrant Police Department, Douglas County Sheriff’s Office, Colombus Police Department, Cass County Sheriff’s Office, Bluff City Police Department, Tennessee Bureau of Investigation, Lincoln Police Department, Gothenburg Police Department, Loudon Police Department, Alcoa Police Department, Milford Police Department, Grand Island Police Department, Nebraska State Patrol, Papillion Police Department, Central City Police Department, Holdrege Police Department, New York State Police, Berkeley Police Department, Cook County Electronic Monitoring Unit, Aurora Police Department, Austin Police Department, U.S. Capitol Police, Buffalo County Sheriff’s Office, City of Rome Police Department, Lancaster County Sheriff’s Office, McCook Police Department, Nebraska DMV Crime Analysts, Rantoul Police Department, Olathe Police Department, North Platte Police Department, Walla Walla Police Department, Milton-Freewater Police Department, Missoula Police Department, Omaha Police Department, Larimer County Sheriff’s Office, Sidney Police Department, Denver Police, Howard County Sheriff’s Office, St. Paul Police Department, Ozaukee County Sheriff’s Office, Glendale Police Department, Columbia Police Department, Brookfield Police Department, Wauwatosa Police Department, Mount Pleasant Police Department, Grafton Police Department, South Milwaukee Police Department, Dubuque Police Department, Fargo Police Department, and Paducah Police Department.
This case is being prosecuted by the Criminal Division’s Computer Crime and Intellectual Property Section, the U.S. Attorney’s Office for the District of Nebraska, and Joint Task Force Vulcan. The Justice Department’s Office of International Affairs, the U.S. Attorney’s Offices for the Western District of Washington, Eastern District of California, Southern District of New York, Northern District of Illinois, Central District of Illinois, Eastern District of Oklahoma and Eastern District of Wisconsin, as well as the Larimer County Attorney’s Office, Colorado Attorney General’s Office, Tennessee 9th District Attorney General’s Office, Tennessee 5th District Attorney General’s Office, the Texas Financial Crimes Intelligence Center, East Baton Rouge Sheriff’s Office, and Louisiana State Police have provided significant assistance.
This Operation is part of the Homeland Security Task Force (HSTF) initiative established by Executive Order 14159, Protecting the American People Against Invasion. The HSTF is a whole-of-government partnership dedicated to eliminating criminal cartels, foreign gangs, transnational criminal organizations, and human smuggling and trafficking rings operating in the United States and abroad. Through historic interagency collaboration, the HSTF directs the full might of U.S. law enforcement towards identifying, investigating, and prosecuting the full spectrum of crimes committed by these organizations, which have long fueled violence and instability within our borders. In performing this work, the HSTF places special emphasis on investigating and prosecuting those engaged in child trafficking or other crimes involving children. The HSTF further utilizes all available tools to prosecute and remove the most violent criminal aliens from the United States. HSTF Omaha comprises agents and officers from the FBI and HSI with the prosecution being led by the U.S. Attorney’s Office for the District of Nebraska.
Joint Task Force Vulcan (JTFV) was created in 2019 to eradicate MS-13 and now expanded at the direction of the Attorney General to target TdA. JTFV is comprised of U.S. Attorney’s Offices across the country, including Southern and Eastern Districts of New York; Eastern and Western Districts of North Carolina; Western District of Virginia; Southern District of Florida; Eastern District of Texas; Western District of Oklahoma; Northern District of Indiana; District of Nevada; and District of Arizona; as well as the Executive Office for U.S. Attorneys, and the Department of Justice’s National Security Division, Criminal Division, and the Office of Judicial Attaché and DEA partners in Bogotá, Colombia. Additionally, the FBI, HSI, Bureau of Alcohol, Tobacco, Firearms and Explosives (ATF), USMS, and the Federal Bureau of Prisons are essential law enforcement partners with JTFV.
CCIPS investigates and prosecutes cybercrime and intellectual property (IP) crime in coordination with domestic and international law enforcement agencies, often with assistance from the private sector. Since 2020, CCIPS has secured the conviction of over 180 cyber and IP criminals, and court orders for the return of over $350 million in victim funds.
