Venezuelan duo indicted in Tulare, Merced, multi-state ATM malware heist

A federal grand jury has indicted two Venezuelan nationals in connection with a so-called ATM “jackpotting” conspiracy that targeted financial institutions in Tulare and Merced counties and six other western states, acting U.S. Attorney Michele Beckwith announced on Thursday. 

Jackpotting involves criminal using master keys and other means to access ATM. hard drives and infect them with malware so they spit out money.

Joel Alejandro Morantes Leal, 25, of San Cristobal, Venezuela, and Endis Daniel Gonzalez Ortega, 22, also of Venezuela, were both charged with conspiracy to commit computer fraud. Additionally, Morantes was charged with bank robbery, one count of accessing a protected computer to further fraud and three counts of attempting to access a protected computer. 

According to court documents, the two men worked with others between April 1 and May 29 to infect ATMs with malware at banks and credit unions in California, Arizona, Oregon, Colorado, Nebraska, Utah and Washington. 

 

Documents show that on April 28, the group targeted Merced School Employees Federal Credit Union. They also targeted the Bank of the Sierra in Tulare on May 8. Surveillance footage shows Morantes at a drive-up trying to get access to an ATM. He was able to open the ATM using a handheld tool, returned later and removed the ATM’s hard drive.

The malware caused the machines to dispense large amounts of cash without proper transactions. Authorities say the group jackpotted or attempted to jackpot over 30 ATMs, stealing hundreds of thousands of dollars. A case in Merced County saw roughly $94,800 taken.   

The FBI is in charge of the investigation with help from the Larimer County Sheriff’s Office in Colorado and the Eugene Police Department in Oregon. Assistant U.S. Attorneys Jeffrey A. Spivak and Arelis M. Clemente are prosecuting the case.

If convicted, the defendants face up to 10 years in prison and $250,000 in fines.