Loading story…
Poland’s Central Bureau for Combating Cybercrime (CBZC) arrested four suspected members of an organized cybercrime group accused of carrying out SIM-swapping attacks that led to the theft of millions of U.S. dollars in cryptocurrency. The investigation, conducted with support from the FBI and U.S. Homeland Security Investigations, alleges the suspects breached telecommunications partners’ IT systems and hijacked employee email accounts using specialized software and social engineering to gather data needed to take over victims’ phone numbers.
Investigators said the group intercepted victims’ SMS messages and email communications, then used that access to compromise cryptocurrency exchange accounts and transfer digital assets. Authorities estimate the proceeds were laundered through bank accounts in multiple countries and digital wallets, with total laundering exceeding tens of millions of Polish złoty. The suspects were placed in pre-trial detention and face charges including participation in an organized criminal group, computer system intrusion, theft-related offenses, and money laundering, with the case supervised by the Regional Prosecutor’s Office in Kraków and still under investigation.
Track how attackers are adapting to this technology.
1 event from the most recent confirmed update back to the earliest known activity.
Poland's Central Bureau for Combating Cybercrime arrested four suspected members of an organized cybercrime group accused of breaching telecommunications partners, hijacking employee email accounts, conducting SIM-swapping attacks, stealing cryptocurrency, and laundering the proceeds. The operation was supported by the FBI and U.S. Homeland Security Investigations, and the suspects were placed in pre-trial detention and charged with offenses including organized crime participation, computer intrusion, theft-related hacking, and money laundering.
Follow how adversaries are adapting to this technology, and where it touches your stack today.
4 references tracked. Mallory keeps watching after this page renders.
helpnetsecurity.com
Open sourcecysecurity.news
Open sourcebleepingcomputer.com
Open sourcecbzc.policja.gov.pl
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
European law enforcement reported multiple cyber-enabled fraud disruptions, including a Eurojust-supported operation that dismantled a **fraudulent call-centre network** operating from three offices in Dnipro. Authorities from Latvia, Lithuania, and Ukraine arrested **11 suspects**, seized **more than €400,000** in cash, and collected electronic evidence (computers, SIM cards, documents) during searches at **32 locations**. The group allegedly ran a fake cryptocurrency investment platform and used **remote access software** to gain access to victims’ online banking and move funds to accounts and crypto wallets under their control. Separately, Poland’s Central Bureau for Combating Cybercrime (CBZC) dismantled an organized group operating in Poland and Germany that used **phishing** to hijack Facebook accounts and extract **BLIK** payment codes. Investigators identified **11 group members**, placed **six** in pretrial detention, and seized **over 100,000** stolen Facebook credentials; prosecutors filed **400+ charges** including unauthorized access, online fraud, and money laundering. A South Korean case involving the breach of Seoul’s bike-hire service *Ttareungyi* (4.62 million users affected) is a distinct incident and not part of the European takedown actions described above.
Jun 29, 2026
Polish law enforcement arrested a **47-year-old man** in the Małopolska/Lesser Poland region on suspicion of involvement with the **Phobos ransomware** operation as part of **Europol-coordinated Operation Aether** targeting Phobos-linked infrastructure and affiliates. During a search of the suspect’s residence, Poland’s Central Bureau/Central Office for Combating Cybercrime (**CBZC**) seized devices and data investigators said could enable unauthorized access and ransomware activity, including **stolen credentials**, **passwords**, **credit card numbers**, and **server IP/access data**. Authorities said technical analysis indicated the seized materials could be used to breach electronic security and support “various attacks, including ransomware,” and alleged the suspect used **encrypted messaging** to communicate with the Phobos criminal group. Reporting also noted the seizure of a laptop and multiple smartphones, and that the suspect was charged with offenses related to creating/acquiring/sharing tools or data used to unlawfully obtain information and facilitate unauthorized system access; if convicted, he faces up to **five years** in prison. Operation Aether reporting additionally linked the enforcement activity to efforts against **8Base**, described as a ransomware group believed to be connected to Phobos.
Jun 29, 2026
Dutch police said they dismantled an international investment fraud operation that allegedly used fake cryptocurrency trading platforms and bogus financial advisers to steal from victims worldwide. Investigators said the network had operated since at least 2021 through roughly 20 to 24 call centers in multiple countries, with more than 700 staff persuading targets to invest and then showing fictitious profits to induce additional payments. Authorities linked at least 550 fraud reports and about **$28.6 million** in reported losses to the group, while estimating victims in the Netherlands alone lost nearly **€25 million** and that tens of thousands of people may have been affected globally. Authorities made multiple arrests across several countries and identified a 46-year-old Israeli-Polish suspect as a central figure in the scheme. The suspect, described as a well-known hacker, was arrested in Poland on May 26 and extradited to the Netherlands; investigators allege he played a key technical and organizational role in helping the group conceal identities, mask call-center locations, and evade law enforcement. Dutch investigators said they traced IP addresses, financial routes, and other digital evidence to map the organization’s infrastructure, and believe the operation at one point generated more than **€100 million per month**.
Jul 18, 2026