Loading story…
European law enforcement agencies have dismantled a sophisticated cybercrime network that provided phone numbers and SIM cards to criminals, enabling a wide range of fraudulent activities across Europe. The operation, coordinated by Europol, involved authorities from Latvia, Austria, and Estonia, and resulted in the arrest of at least five to seven individuals, including the alleged organizer of the illicit service. During the raids, police seized 1,200 SIM box devices containing 40,000 active SIM cards, as well as five servers and hundreds of thousands of additional SIM cards. The network operated an online platform that allowed criminals to rent phone numbers registered in more than 80 countries, which were then used to create fake accounts on social media and messaging platforms. These accounts facilitated crimes such as phishing, investment scams, account intrusions, credential and financial data theft, extortion, migrant smuggling, and the distribution of child sexual abuse material. Investigators linked the group to over 3,000 cyber fraud cases, with financial losses exceeding 5 million euros ($5.8 million), primarily in Austria and Latvia. The infrastructure supporting the operation was described as highly advanced and professionally organized, featuring a polished website and a global logistics network for procuring SIM cards. The service appeared to operate as a legitimate business, masking its true purpose and scale. Authorities estimate that more than 49 million online accounts were created using the illicit service, allowing criminals to conceal their identities and locations. The operation, dubbed "SIMCARTEL," involved 26 searches in Latvia and was described by Latvian police as unprecedented in scale and complexity. One of the main suspects had a prior criminal history in Estonia, including arson and extortion. The takedown of this network is considered a significant blow to cybercriminals who rely on anonymous phone numbers to evade detection and law enforcement. Europol emphasized the unique and novel nature of the scheme, noting that it posed a new challenge for European authorities. The successful operation demonstrates the effectiveness of international cooperation in combating organized cybercrime. The seized infrastructure and arrests are expected to disrupt ongoing and future cyber-enabled fraud schemes across Europe and beyond. Authorities continue to investigate the full extent of the network's activities and its connections to other criminal enterprises.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
Investigators arrested five Latvian nationals and seized servers, SIM-box equipment, SIM cards, and luxury vehicles as part of the takedown. Officials said the investigation was ongoing to determine the full scope of the operation and associated fraud losses.
European law enforcement agencies carried out Operation SIMCARTEL, raiding infrastructure in countries including Latvia, Austria, and Estonia and dismantling the network used to supply phone numbers to scammers. Authorities also took down websites used to rent numbers for criminal activity.
A transnational criminal organization used about 1,200 SIM-boxes and 40,000 SIM cards to rent out phone numbers for phishing, smishing, investment fraud, impersonation, extortion, and the creation of more than 49 million fake online accounts. The activity was linked to more than 3,200 fraud cases and millions of euros in losses.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
5 references tracked. Mallory keeps watching after this page renders.
darkreading.com
Open sourcethehackernews.com
Open sourcesecurityaffairs.com
Open sourcetherecord.media
Open sourcecyberscoop.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
International law enforcement agencies dismantled three interconnected credit card fraud and money laundering networks responsible for defrauding millions of victims worldwide. The operation, coordinated by Eurojust and Europol and involving authorities from Germany, the USA, Canada, Singapore, Luxembourg, Cyprus, Spain, Italy, and the Netherlands, resulted in the arrest of 18 individuals, including five executives from four German payment service providers. The fraudsters used stolen credit card data to create fake online subscriptions for dating, pornography, and streaming services, keeping charges below €50 to avoid detection and laundering proceeds through shell companies and complicit payment providers. Authorities estimate the fraud affected over 4.3 million cardholders, involved 19 million accounts, and resulted in losses exceeding €300 million, with attempted fraud totaling more than €750 million. The investigation began in Luxembourg and expanded globally, with German authorities conducting 29 searches and seizing assets worth over €35 million, including luxury vehicles, cryptocurrency, and electronic devices. The suspects, hailing from multiple countries, are accused of exploiting payment infrastructure and using shell companies in Cyprus and the UK to obscure transactions. The operation, dubbed "Operation Chargeback," highlights the role of complicit financial service providers and the use of "Crime-as-a-Service" vendors to facilitate large-scale, cross-border financial crime. The case underscores the complexity and international scope of modern payment fraud and the importance of coordinated law enforcement action.
Jul 12, 2026
European law enforcement agencies, supported by Eurojust, have dismantled a large-scale fraud network operating multiple call centers in Ukraine that targeted victims across Europe. Authorities from Ukraine, the Czech Republic, Latvia, and Lithuania arrested 12 suspects and identified 45 individuals involved in the operation, which defrauded over 400 victims of more than 10 million euros. The criminal group used various schemes, including impersonating police officers and bank employees, convincing victims their accounts were compromised, and instructing them to transfer funds to "safe" accounts controlled by the network. In some cases, victims were persuaded to install remote access software, allowing the criminals to hijack their bank accounts, and some fraudsters even met victims in person to collect cash using stolen card details. The call centers, located in Dnipro, Ivano-Frankivsk, and Kyiv, employed around 100 people recruited from several European countries. Employees were paid commissions of up to 7% of the stolen funds and were promised bonuses such as cash, cars, or apartments for exceeding certain fraud targets, though these rewards were never distributed. During coordinated raids on December 9, 2025, authorities conducted 72 searches, seizing vehicles, weapons, computers, cash, and forged identification documents. The operation highlights the transnational nature of organized fraud and the effectiveness of coordinated law enforcement action across European borders.
Jun 29, 2026
European law enforcement reported multiple cyber-enabled fraud disruptions, including a Eurojust-supported operation that dismantled a **fraudulent call-centre network** operating from three offices in Dnipro. Authorities from Latvia, Lithuania, and Ukraine arrested **11 suspects**, seized **more than €400,000** in cash, and collected electronic evidence (computers, SIM cards, documents) during searches at **32 locations**. The group allegedly ran a fake cryptocurrency investment platform and used **remote access software** to gain access to victims’ online banking and move funds to accounts and crypto wallets under their control. Separately, Poland’s Central Bureau for Combating Cybercrime (CBZC) dismantled an organized group operating in Poland and Germany that used **phishing** to hijack Facebook accounts and extract **BLIK** payment codes. Investigators identified **11 group members**, placed **six** in pretrial detention, and seized **over 100,000** stolen Facebook credentials; prosecutors filed **400+ charges** including unauthorized access, online fraud, and money laundering. A South Korean case involving the breach of Seoul’s bike-hire service *Ttareungyi* (4.62 million users affected) is a distinct incident and not part of the European takedown actions described above.
Jun 29, 2026