# Five Venezuelans Just Pleaded Guilty to Making ATMs Spit Cash on Demand
ATM jackpotting sounds like a magic trick. Walk up to a cash machine, connect a device or push a command, and watch it vomit bills. It's not a trick — it's a sophisticated criminal operation that has drained millions from US financial institutions, and five Venezuelan nationals just admitted in federal court that they were part of it.
The guilty pleas, unsealed recently by the Justice Department, mark a rare successful prosecution of a jackpotting crew operating on American soil. For years, this category of financial crime was viewed almost as a European and Latin American problem — something that happened to Diebold machines in Mexico City or Wincor ATMs in Spain. Not anymore.
## How the Machine Gets Robbed
There are two main jackpotting techniques, and they're worth understanding because the defense against each is different.
The first is the black-box attack: criminals open an ATM's top cabinet (often using keys bought online or stolen from technicians), physically disconnect the cash dispenser, and plug in a laptop or Raspberry Pi running attack software. The machine's cash mechanism gets fooled into thinking it's receiving legitimate instructions from the ATM's internal computer. Money flows out. The attacker collects it in a bag and walks away.
The second approach — and the one increasingly favored by sophisticated crews — is software-only jackpotting using malware like Ploutus-D, Tyupkin, or proprietary strains purpose-built for specific ATM manufacturers. These tools compromise the ATM's underlying Windows operating system (yes, most ATMs still run Windows, often end-of-life versions), load a control application that intercepts the XFS layer — the middleware that translates software commands into hardware actions — and hand a "mule" standing at the machine a code or timing window to trigger dispensing.
The mule's job is the dumbest and most dangerous part. They stand at an ATM in broad daylight, punch in a sequence, and stuff cash into a bag. Surveillance cameras everywhere. No technical knowledge required. Maximum exposure. These are the people who get caught first.
## The Venezuelan Connection
Venezuela's economic collapse over the past decade produced a specific class of criminal emigration: tech-literate, desperate, and plugged into transnational networks that already had established jackpotting expertise across Latin America. Brazilian and Mexican crews pioneered many of the techniques. Venezuelan nationals have increasingly appeared in jackpotting prosecutions across the US, Europe, and South America.
This isn't profiling — it's pattern. Federal prosecutors, Secret Service agents, and bank security teams have documented the network structure repeatedly. There's a technical cell that handles malware deployment and ATM reconnaissance. There's a logistics layer for moving money and people. And there are the cashers, the ground-level workers who show up at machines with their faces on camera.
The five men who pleaded guilty almost certainly occupied different rungs of that structure. Federal charging documents in jackpotting cases routinely reveal that some defendants knew exactly what malware they were deploying and which ATM firmware versions it exploited, while others simply knew which parking lot to stand in and what number to dial when the job was done.
## The ATM Industry's Quiet Vulnerability Problem
Here's what the press releases won't say plainly: ATMs are a security catastrophe in slow motion, and the industry has known it for fifteen years.
The XFS standard — the middleware that jackpotting malware targets — was designed for interoperability, not security. It assumes that any application running on the ATM's operating system is trusted. There's no authentication between software layers. If your malware is on the machine, you own the cash dispenser.
Diebold Nixdorf and NCR have both issued security advisories and pushed software patches to address jackpotting vulnerabilities. Banks have been told to apply them. Not all have. ATM maintenance is a pain: machines are in remote locations, run by third-party servicers, on networks maintained by contractors, often with update cycles measured in years rather than weeks.
The Secret Service first warned US financial institutions about jackpotting specifically targeting Diebold ATMs in January 2018. Eight years later, we're still prosecuting jackpotting crews.
## What Defenders Actually Need to Do
A guilty plea is satisfying. It doesn't patch anything.
Banks and credit unions operating ATM fleets should be doing three things right now:
Audit firmware versions aggressively. Every ATM in your fleet should be running current manufacturer firmware with XFS security patches applied. If you're using a third-party servicer, get proof — not assurance, proof.
Deploy application whitelisting. Jackpotting malware has to execute on the ATM's Windows environment. Application whitelisting tools (Bit9, Carbon Black, manufacturer-supplied solutions) can block unauthorized code from running. This is one of the more effective technical controls available and still dramatically underdeployed.
Treat physical access as a security event. The cabinet breach — opening the top portion of an ATM to connect hardware — should trigger an alert. Tamper-evident seals and vibration sensors exist and are cheap. Many operators still don't use them consistently.
---
## HackWire Analysis
Five guilty pleas make good headlines. They don't answer the question that matters: why is jackpotting still working in 2026?
The answer is structural, not tactical. ATM security sits at an awkward intersection of banking, physical retail, and industrial control systems — and it inherits the worst security posture from all three. Banks outsource ATM maintenance. Servicers run skeleton crews. Firmware updates require physical access to machines scattered across thousands of locations. The incentive to accept a little risk is always stronger than the incentive to schedule a nationwide update campaign.
Meanwhile, jackpotting malware has gotten more capable, not less. Early strains like Tyupkin were crude — they required physical installation, had hard-coded activation keys, and only worked on specific machine models. Modern strains are modular, work across multiple ATM families, and in some documented cases have been delivered remotely through compromised bank back-office networks — no physical access to the ATM cabinet at all.
The Latin American crews prosecuted today are not the ceiling of this threat. They're the floor. Nation-state-adjacent actors in Eastern Europe have refined jackpotting toolkits that would make these operations look primitive. What gets deployed against a credit union in Ohio isn't necessarily the same as what's being tested in labs you've never heard of.
The conviction of five individuals is law enforcement doing its job. The more important story is whether the ATM industry is finally doing theirs. The Secret Service has been sounding this alarm since 2018. Eight years of warnings, and mules are still standing at machines with bags.
That's not a prosecution problem. That's a patch management problem.
— HackWire Editorial
---
## Related Coverage