Loading story…
European law enforcement agencies, supported by Eurojust, have dismantled a large-scale fraud network operating multiple call centers in Ukraine that targeted victims across Europe. Authorities from Ukraine, the Czech Republic, Latvia, and Lithuania arrested 12 suspects and identified 45 individuals involved in the operation, which defrauded over 400 victims of more than 10 million euros. The criminal group used various schemes, including impersonating police officers and bank employees, convincing victims their accounts were compromised, and instructing them to transfer funds to "safe" accounts controlled by the network. In some cases, victims were persuaded to install remote access software, allowing the criminals to hijack their bank accounts, and some fraudsters even met victims in person to collect cash using stolen card details.
The call centers, located in Dnipro, Ivano-Frankivsk, and Kyiv, employed around 100 people recruited from several European countries. Employees were paid commissions of up to 7% of the stolen funds and were promised bonuses such as cash, cars, or apartments for exceeding certain fraud targets, though these rewards were never distributed. During coordinated raids on December 9, 2025, authorities conducted 72 searches, seizing vehicles, weapons, computers, cash, and forged identification documents. The operation highlights the transnational nature of organized fraud and the effectiveness of coordinated law enforcement action across European borders.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
In a related but separate operation, Czech and Ukrainian authorities took down another fraud group based in Kyiv that used fake investment websites. That scheme caused nearly $2 million in losses.
In a coordinated operation led with Eurojust support, law enforcement carried out 72 searches in three Ukrainian cities and dismantled the fraud network. Authorities arrested 12 people, identified 45 suspects, and seized forged IDs, computers and other electronics, cash, vehicles, and weapons.
Over the course of the operation, the network defrauded more than 400 victims across Europe of over 10 million euros by convincing them to transfer funds or grant access to their bank accounts. Investigators said the true number of victims may be higher.
A criminal organization established professional scam call centers in Kyiv, Dnipro, and Ivano-Frankivsk, recruiting staff from multiple European countries. The group impersonated police officers and bank employees and used social engineering and remote-access tools to steal money from victims across Europe.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
therecord.media
Open sourcebleepingcomputer.com
Open sourcehelpnetsecurity.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
European law enforcement reported multiple cyber-enabled fraud disruptions, including a Eurojust-supported operation that dismantled a **fraudulent call-centre network** operating from three offices in Dnipro. Authorities from Latvia, Lithuania, and Ukraine arrested **11 suspects**, seized **more than €400,000** in cash, and collected electronic evidence (computers, SIM cards, documents) during searches at **32 locations**. The group allegedly ran a fake cryptocurrency investment platform and used **remote access software** to gain access to victims’ online banking and move funds to accounts and crypto wallets under their control. Separately, Poland’s Central Bureau for Combating Cybercrime (CBZC) dismantled an organized group operating in Poland and Germany that used **phishing** to hijack Facebook accounts and extract **BLIK** payment codes. Investigators identified **11 group members**, placed **six** in pretrial detention, and seized **over 100,000** stolen Facebook credentials; prosecutors filed **400+ charges** including unauthorized access, online fraud, and money laundering. A South Korean case involving the breach of Seoul’s bike-hire service *Ttareungyi* (4.62 million users affected) is a distinct incident and not part of the European takedown actions described above.
Jun 29, 2026
Austrian and Albanian authorities, supported by **Europol** and **Eurojust**, dismantled a large online investment fraud operation that allegedly stole at least **€50 million** from victims across Europe and other regions. The network operated from call centers in **Tirana, Albania**, where investigators said it was run like a legitimate business with up to **450 employees** spanning management, finance, IT, HR, customer acquisition, and retention roles. Victims were lured through fake broker and cryptocurrency investment platforms promoted on search engines, websites, and social media, then pressured by multilingual operators posing as brokers or advisers to transfer more money. A coordinated action on **17 April** led to **10 arrests**, searches of **three call centers** and **nine homes**, and the seizure of **€891,735 in cash** along with hundreds of computers and phones. Investigators said the group used remote access software and an international money-laundering scheme to divert funds rather than invest them, and in some cases targeted victims a second time with a bogus recovery service that demanded a **€500** cryptocurrency payment. Authorities said the seized infrastructure and data are expected to support additional investigations in other affected countries.
Jul 3, 2026
Spanish and Ukrainian authorities, supported by **Europol**, dismantled a criminal network that exploited war-displaced **Ukrainian women** to facilitate an online gambling fraud and money-laundering operation. Investigators said the group recruited vulnerable women from heavily attacked regions, transported them to Spain, and escorted them through obtaining temporary protection status and opening bank accounts and credit cards—then seized control of those accounts to run the scheme. Police arrested **12 suspects** following a **two-year investigation** and identified **55 Ukrainian women** used in the operation, which generated roughly **€4.75 million (about $5.5 million)** in illicit proceeds. The network allegedly used **bot-driven automation** to place thousands of simultaneous **low-odds bets** across online gambling platforms to produce steady, seemingly legitimate returns, while leveraging **stolen identities** (over **5,000** across **17 nationalities**) to create and operate large numbers of betting accounts; authorities said proceeds were also funneled into assets including **luxury real estate** in Europe.
Jun 29, 2026