U.S. authorities have charged two Tajik nationals and one Iranian citizen with orchestrating a cyberattack on ATMs to steal cash using a method known as “jackpotting.” Two of the suspects have already been apprehended.
Law enforcement in Lincoln County, North Carolina, identified the suspects as 26-year-old Nurmuhammad Rahmonzoda, 35-year-old Firdavs Rajabov, and 36-year-old Milod Avazdavani of Iran. The crimes reportedly occurred in February 2025 in the state of Maine.
Investigators were able to identify the suspects using CCTV footage and license plate recognition systems. The group allegedly employed jackpotting, a cyber intrusion technique that manipulates ATMs into dispensing cash without recording a legitimate transaction.
The investigation was launched after multiple banks reported technical issues with their self-service terminals. Authorities later determined the cyberattacks had been premeditated and synchronized across several ATM locations. In total, the group is accused of stealing more than $10,000.
Avazdavani was arrested on March 13, 2025, in Charleston, South Carolina. Rahmonzoda was detained two weeks later in Florida and transferred to Maine. Authorities have not confirmed whether Rajabov has been taken into custody.
Rahmonzoda has been formally charged with theft. A court has ordered him to pay $38,480 in restitution to the victims. If he fulfils the court’s compensation order, the felony charge may be downgraded to a misdemeanor, though full criminal liability will still apply. Further proceedings in the case are set to continue in Florida.
Previously, U.S. media reported the arrests of other Tajik citizens in unrelated cases involving terrorism and immigration violations.
