Loading story…
UK authorities have charged five people following a National Crime Agency investigation into Russian Coms, a fraud-enablement platform accused of powering large-scale scam calling campaigns. Investigators said the service, launched in 2020, allowed criminals to spoof trusted caller IDs and impersonate banks, telecommunications providers, and law enforcement agencies to steal money and personal information. The defendants face allegations including conspiracy to supply articles for use in connection with fraud, along with multiple money-laundering-related offenses tied to proceeds allegedly generated by selling the platform’s devices and applications.
The NCA said Russian Coms was linked to more than 1.8 million scam calls, roughly 170,000 victims, and tens of millions in losses. The platform was promoted through Telegram, Snapchat, and Instagram, accepted cryptocurrency payments, and offered handset and web-based tools with features including encrypted calls, no-logs functionality, voice changing, and instant handset wipes. Authorities previously disrupted the service in March 2024 as part of Operation Henhouse, a wider anti-fraud campaign that led to 290 arrests across the UK, and the five defendants are due to appear at Westminster Magistrates’ Court.
See the reporting duties and controls this puts on the clock.
4 events from the most recent confirmed update back to the earliest known activity.
In March 2024, the UK National Crime Agency disrupted Russian Coms as part of Operation Henhouse, a broader anti-fraud effort. The platform was linked to more than 1.8 million scam calls, roughly 170,000 victims, and tens of millions in losses.
The five defendants are scheduled to appear at Westminster Magistrates’ Court on 14 August following the charges announced in the Russian Coms investigation.
The UK National Crime Agency announced charges against five individuals in connection with its investigation into Russian Coms, including conspiracy to supply articles for use in connection with fraud and multiple money-laundering-related offenses.
The Russian Coms caller ID spoofing platform was established in 2020, initially as a handset product before later evolving into a web-based application used to facilitate scam calls.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See what this changes for your reporting obligations and which controls it puts on the clock.
4 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourcehelpnetsecurity.com
Open sourcebleepingcomputer.com
Open sourcenationalcrimeagency.gov.uk
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
U.S. prosecutors unsealed charges against five men allegedly linked to the **Scattered Spider** cybercrime ecosystem, accusing them of running a large-scale scheme that used SMS phishing, spoofed login pages, social engineering, stolen employee credentials, email hijacking, and SIM swapping to compromise companies and individuals. Court filings say the operation targeted technical employees across the United States between September 2021 and April 2023, enabling the theft of non-public corporate data, personal identifiers, and **millions of dollars in cryptocurrency**. Four suspects were charged in the United States with conspiracy to commit wire fraud, while a separate complaint was filed against a fifth defendant in the United Kingdom. The case adds to mounting law-enforcement scrutiny of Scattered Spider, a loose English-speaking threat actor network also tracked under multiple aliases and associated with the broader **"Com"** ecosystem. Authorities and researchers have linked the group to high-profile intrusions and collaborations with ransomware operations including **BlackCat/ALPHV**, **Qilin**, and **RansomHub**, as well as incidents affecting MGM Resorts, Clorox, Snowflake-linked victims, and later investigations into the hacks at **Marks & Spencer** and **Co-op**. The charges mark a significant escalation in efforts to disrupt a group known for blending phishing, identity takeover, and extortion-focused intrusion tactics.
Jun 29, 2026
The UK unveiled a national fraud strategy that shifts more responsibility for stopping scams onto telecom providers, technology platforms, and financial firms, backed by a new **Online Crime Centre** with more than **£30 million** to coordinate the National Crime Agency, GCHQ, police, and private-sector partners. The plan focuses on disrupting fraud infrastructure upstream by blocking scam texts, freezing accounts, and removing fraudulent online profiles, while replacing Action Fraud with a new **Report Fraud** system and pursuing a national capability to trace scam calls across networks. The broader UK push builds on earlier action to ban illegitimate **SIM farms**, a tool used to send mass scam texts and create large numbers of verified accounts, with operators already reporting more than **1 billion** suspected scam messages blocked since 2023.
Jun 29, 2026
Ukrainian authorities dismantled **94 fraudulent call centers** in a nationwide operation involving the National Police of Ukraine, the Cyber Police Department, the Security Service of Ukraine, the Prosecutor General’s Office, and German law enforcement. Investigators carried out **more than 400 searches**—reported as **411 raids**—and formally identified **26 suspects** tied to schemes that targeted victims through fake banking, investment, and law-enforcement impersonation scams. According to investigators, operators persuaded victims to hand over money, disclose banking access, or install remote-access software, while some operations also marketed bogus medical products. Police seized large quantities of computer equipment, phones, SIM cards, bank cards, cash, vehicles, gold, and tools used to access cryptocurrency wallets, and authorities are now conducting forensic analysis to identify victims, calculate losses, and build cases against organizers, money mules, and laundering networks.
Aug 16, 2026