FBI in Connecticut Arrests Four in $500K ATM Jackpotting

FBI in Connecticut investigators, in coordination with the Homeland Security Task Force (HSTF) and federal prosecutors, have arrested and charged four Venezuelan nationals accused of executing a highly sophisticated “ATM jackpotting” crime spree. Over a rapid ten-day window in August 2025, the group targeted commercial ATM terminals at highly trafficked Interstate 95 rest stops and municipal hubs, successfully stealing more than $500,000. Operating under the cover of night and shifting physical disguises, the defendants systematically forced financial infrastructure to spit out massive reserves of cash before fleeing across state lines.

According to federal complaints unsealed by David X. Sullivan, the United States Attorney for the District of Connecticut, and P.J. O’Brien, Special Agent in Charge of the FBI New Haven Division, the crew specialized in logical-physical attacks on automated teller machines. This aggressive form of financial cybercrime bypasses standard debit card authorization, commanding cash-dispenser modules directly via connected foreign hardware and unauthorized execution of malware. The coordinated law enforcement effort successfully halted a highly profitable operation that points to a wider national wave of technology-enabled bank burglaries.

Understanding the Connecticut ATM Jackpotting Syndicate

The arrest of the four individuals marks a major victory for federal and state investigators who have been tracking organized crews moving along the East Coast. Unlike classic “skimming” operations that aim to steal personal customer data to replicate cards, “jackpotting” seeks to completely drain the machine’s physical safe. It requires technical coordination, rapid timing, and dedicated roles—attributes that were highly organized within this particular syndicate.

These defendants did not operate in isolation; prosecutors allege they conspired with other unidentified individuals to exploit structural physical vulnerabilities in standard ATM models. By targeting key commuter plazas on Interstate 95 and nearby towns, they selected high-volume machines that were likely to be fully loaded with large cash balances to accommodate weekend travelers. The geographic spread of their targets showed a strategic focus on the busy transit corridor connecting New York, Connecticut, and Massachusetts.

Who are the Suspects? Profile of the Accused

The federal complaint names four defendants, all of whom are Venezuelan nationals residing in different states along the East Coast. Their decentralized living arrangements suggest a mobile network capable of converging rapidly on target locations before returning to their respective safehouses:

• Euclides Moreno Itanare, 28, residing in Raleigh, North Carolina.
• Willian Ricardo Flores, 49, residing in the Bronx, New York.
• Alberto Jose Freites Arvilla, 41, residing in Queens, New York.
• Luis Jose Freites Arvilla, 38, residing in Lynn, Massachusetts.

According to official declarations from the U.S. Department of Justice, the group’s coordinated dynamics relied heavily on the technical skills of Alberto Jose Freites Arvilla and the protective oversight of Luis Jose Freites Arvilla, while Itanare and Flores acted as active cash collectors during the hours-long draining sequences.

Inside the Mechanics of “ATM Jackpotting”

ATM jackpotting—referred to in technical security spheres as a logical-physical attack—is one of the most destructive and fast-growing threats facing financial institutions worldwide. The concept was first brought to widespread public attention by legendary security researcher Barnaby Jack at the 2010 Black Hat conference, where he famously demonstrated how an ATM could be forced to spit out cash on demand using external software commands.

In a typical jackpotting deployment, criminals must first gain physical access to the interior components of the ATM. This is accomplished not by blowing up the safe, but by breaching the top cabinet (the “upper console” or “hood”), which houses the machine’s computer core, motherboard, and communication ports. The lower safe containing the cash cassettes remains physically locked and untouched during this initial phase, which helps bypass local physical seismic and tamper alarms in some older ATM configurations.

Physical and Digital Compromise of Cash Dispensers

Once the upper cabinet is unlocked or pried open, the attacker connects a specialized hardware device, such as a laptop, a customized microcontroller, or a mobile device, directly to the ATM’s internal computer bus. Often, they will disconnect the cash-dispensing module from the ATM’s main processor and attach their own controller to it. This step effectively cuts off the machine’s connection to the banking network, preventing the bank’s security team from seeing real-time transaction anomalies.

The next phase involves executing specialized malware, such as the notorious “Ploutus” family or its modern variants. This malware instructs the cash-dispenser module to immediately initiate cash-out commands. Instead of processing a legitimate withdrawal of a few hundred dollars against a checking account, the dispenser is forced to cycle continuously, dispensing the maximum number of bills per second until the cassettes are entirely empty. The ATM is quite literally turned into a slot machine that has hit the jackpot, hence the term.

The Connecticut I-95 Crime Spree: A Two-Week Timeline

The conspiracy reached its operational peak over a dense ten-day span between August 8, 2025, and August 18, 2025. In this brief period, the group successfully hit eight distinct ATM locations, collecting an astonishing total of $529,220. The efficiency of their campaign reveals a high level of technical familiarity with the specific models of ATMs placed at Connecticut’s state-operated rest stops and service plazas along Interstate 95.

By hitting multiple plazas along a linear transit route, the crew minimized travel time while maximizing potential returns. Rest stops are historically chosen for these types of crimes due to their open, 24/7 nature, the relative anonymity of the crowds, and the immediate proximity of highway entrance and exit ramps, which allow for a rapid escape into neighboring states. The following table illustrates the operational footprint of the syndicate across Connecticut during their August crime spree.

Target Location	Location Type	Outcome	Heist Details & Operational Impact
Fairfield (Northbound)	I-95 Rest Stop	Successful	Single largest haul, netting $136,000 in a continuous draining session.
Milford	City Location	Successful	Contributed to the overall $529,220 stolen cash cache.
Branford	I-95 Rest Stop	Successful	Drained multiple cash cassettes under the cover of night.
Madison	I-95 Rest Stop	Successful	Targeted weekend travel cash reserves.
Darien	I-95 Rest Stop	Successful	Initial entry points of the physical crime corridor.
Ansonia	City Location	Failed Attack	Thwarted completely by active cryptographic and software security patches.

High-Value Heists from Darien to New Haven

The geographic corridor from Darien to New Haven represents one of the busiest economic arteries in the United States, hosting thousands of out-of-state travelers, commercial trucks, and tourists every day. Because of this, the service plazas along this route are heavily used, and their ATMs are frequently replenished with large sums of money. The suspects utilized this density to blend in with standard highway users.

In towns like Milford, Branford, Madison, and Darien, the suspects targeted ATMs located inside or adjacent to the service plazas. The boldness of the scheme was remarkable: while travelers ordered food and filled their vehicles with fuel just yards away, the syndicate was actively manipulating the electronic brains of the cash machines, turning public conveniences into high-yield illicit operations.

The Fairfield Northbound Plaza Heist: A $136,000 Haul

The absolute peak of the crew’s criminal campaign occurred at the northbound I-95 rest stop in Fairfield, Connecticut. At this single location, prosecutors allege that the suspects successfully completed an uninterrupted, highly efficient jackpotting attack that net them an astonishing $136,000 in cash.

During this heist, the crew managed to access the internal system of the ATM without raising immediate alarms. Once the malware took control of the dispenser, the suspects were able to command the machine to continuously dump its highest-denomination bills. Draining such a massive volume of physical cash required the suspects to stand by the machine for an extended period, filling bags with bundles of bills while keeping a constant vigil for state troopers or security personnel.

How Law Enforcement Tracked and Apprehended the Crew

Despite the sophisticated digital tools used by the suspects, they were ultimately undone by traditional police work, surveillance networks, and a critical lack of operational security in the physical world. The FBI’s New Haven Division, alongside local police departments in Milford, Ansonia, and state police units patrolling the I-95 corridor, began reconstructing the conspiracy immediately after the first wave of hits was reported by the victimized financial institutions.

A crucial breakthrough came when investigators analyzed high-definition surveillance footage from the various service plaza ATMs. Despite the suspects’ attempts to cover their physical identities and avoid patterns, investigators noticed a highly repetitive, calculated choreography in how each ATM was approached, manipulated, and ultimately drained.

Surveillance Footage and the Tactical Modus Operandi

According to federal court filings, surveillance video captured a clear division of labor that the group utilized at every single target location. The operation was executed in distinct physical phases:

First, Luis Jose Freites Arvilla would enter the rest stop terminal or approach the ATM lobby to act as a lookout, scanning the surrounding area for law enforcement or suspicious bystanders. Once the area was deemed clear, Alberto Jose Freites Arvilla would approach the machine, quickly open the upper hood, access the internal computing components to connect their hardware, install the jackpotting malware, and then immediately leave the immediate vicinity.

Once the machine was compromised and the dispenser was cycling under malware control, the remaining members of the conspiracy—Luis Freites Arvilla, Euclides Moreno Itanare, and Willian Ricardo Flores—would take turns walking up to the ATM to withdraw large, endless streams of cash. To avoid triggering alarms or drawing the attention of rest stop staff who might notice the same individual standing at an ATM for hours, the suspects frequently changed their clothing between cash-dispensing sessions, swapping hats, jackets, and shirts in nearby vehicles before returning for another haul.

Software Patches and Cybersecurity: The Ansonia Exception

The critical importance of robust cybersecurity protocols was perfectly illustrated during the syndicate’s attempted hit on an ATM in the city of Ansonia, Connecticut. Unlike the successful thefts at the other eight locations, the suspects walked away from the Ansonia terminal completely empty-handed.

According to federal investigators, the Ansonia ATM was protected by a modern software security patch designed specifically to counter logical jackpotting attacks. Modern security patches often introduce physical-digital handshakes, requiring cryptographic authentication between the ATM’s main operating system and the cash-dispensing controller. When the suspects attempted to inject their malware or disconnect the dispenser to bypass authorization, the secure firmware detected the unauthorized physical hardware and immediately shut down the dispenser, lock-protecting the cash reserves. This failure highlights the vital need for banks and independent ATM operators to aggressively deploy software updates and firmware protection across all terminal fleets.

The Transnational Threat: Connection to Global Criminal Organizations

The arrest of these four Venezuelan nationals in Connecticut is not an isolated incident, but rather part of a highly concerning national trend. Federal law enforcement agencies, including the FBI and Homeland Security Investigations (HSI), have warned that ATM jackpotting has evolved into a primary revenue stream for transnational criminal organizations (TCOs) operating within the United States.

In particular, federal prosecutors have linked widespread jackpotting networks to the Tren de Aragua (TdA), a violent transnational street gang originating from Venezuela that has rapidly expanded its footprint across North America. In a closely related case in June 2026, federal judges sentenced two other Venezuelan nationals—Carlos Javier Padron and Oddry Arnoldo Cabrera Torrealba—to 78 months in prison for deploying Ploutus malware to steal millions from ATMs across the country. U.S. Attorneys in those cases explicitly stated that ATM jackpotting serves as a “business plan” and a major funding pipeline for TdA’s broader illicit operations, including human trafficking, narcotics distribution, and violent crime.

Legal Charges, Pending Prosecutions, and Potential Sentences

Following their arrest on federal complaints on June 25, 2026, the four defendants are facing severe legal consequences under federal criminal statutes. The prosecution is being led by the U.S. Attorney’s Office for the District of Connecticut, which is presenting a mountain of physical, digital, and surveillance evidence gathered by the joint federal and state task force.

Each of the four defendants has been charged with:

• Interstate Transportation of Stolen Property: A federal charge carrying a maximum potential sentence of 10 years in federal prison upon conviction.
• Conspiracy to Commit Interstate Transportation of Stolen Property: A charge carrying a maximum potential sentence of 5 years in federal prison.

In addition to significant prison terms, a conviction under federal guidelines will likely result in mandatory financial restitution orders to the victim banks, forfeiture of all seized illicit assets, and subsequent deportation proceedings for the non-citizen defendants after serving their sentences. As the case moves to a grand jury indictment, law enforcement continues to investigate whether this specific crew was responsible for additional unsolved ATM thefts across the wider Northeast region.