Loading story…
Spanish National Police, working with international partners, dismantled a cybercrime organization accused of stealing and laundering about €140 million through fake investment platforms, business email compromise (BEC), CEO fraud, invoice fraud, and man-in-the-middle attacks. Investigators said the group operated an industrial-scale laundering network tied to more than 800 bank accounts, 120 business accounts, 19 companies, and 67 money mules, with confirmed links to over €94 million in transactions and another €61 million connected to 2024 CEO fraud activity.
Authorities arrested four suspects in Spain, Portugal, and Panama during an operation supported by Europol and Interpol. Raids in Spain and Portugal led to the seizure of computers, smartphones, and other digital devices allegedly used in the schemes, while police froze €3 million in criminal proceeds for potential victim restitution. Officials said the network’s main operators were taken into custody and the laundering infrastructure was effectively dismantled, though the investigation into its wider international links remains ongoing.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
In an operation spanning Spain, Portugal, and Panama, authorities arrested four suspects, raided locations in Spain and Portugal, seized computers and smartphones or other digital devices, and froze €3 million in criminal proceeds for victim restitution. Interpol and Europol supported the action, and police said the network’s main operators had been arrested.
Spanish National Police dismantled a cybercrime and money-laundering organization accused of stealing and laundering about €140 million through fake investment platforms, CEO fraud, invoice fraud, BEC, and man-in-the-middle attacks. Authorities said the group used more than 800 bank accounts, 120 business accounts, and 67 money mules, with over €94 million in traced transactions.
Spanish authorities said the network was tied to €61 million defrauded in 2024 through a CEO fraud/business email compromise scheme. This activity was cited as part of the broader criminal operation later dismantled by police.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
4 references tracked. Mallory keeps watching after this page renders.
darkreading.com
Open sourcescworld.com
Open sourcehelpnetsecurity.com
Open sourcebleepingcomputer.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Spanish National Police, in collaboration with German authorities and Europol, arrested 34 individuals linked to the Black Axe criminal organization in a coordinated operation across Seville, Madrid, Málaga, and Barcelona. The suspects, primarily of Nigerian origin, are accused of orchestrating large-scale cyber fraud schemes, including business email compromise (BEC), romance scams, and phishing attacks, resulting in nearly €6 million in losses in Spain alone. Authorities seized cash, electronic devices, vehicles, and froze significant sums in bank accounts during the raids, while also uncovering the group's strategy of recruiting vulnerable locals as money mules to launder illicit proceeds. The Black Axe group, originating from Nigeria and now boasting an estimated 30,000 members worldwide, has been implicated in a range of criminal activities, with cyber-enabled fraud as a major revenue stream. The investigation revealed that the Spanish cell was part of a broader European network, using sophisticated man-in-the-middle (MITM) tactics to intercept and redirect corporate payments. Four main suspects have been placed in pretrial detention, facing charges including aggravated fraud, money laundering, and membership in a criminal organization, while authorities continue to pursue additional leads and potential arrests.
Jun 29, 2026
Law enforcement agencies across multiple countries have conducted significant operations targeting cybercriminal groups responsible for large-scale financial fraud, data breaches, and cryptocurrency theft. In Spain, police arrested a 19-year-old hacker accused of stealing and attempting to sell 64 million personal data records from nine companies, while Ukrainian authorities apprehended a separate data broker who used custom malware to compromise accounts and sell access on hacker forums. In California, a member of the so-called "Social Engineering Enterprise" pleaded guilty to laundering millions in cryptocurrency stolen through sophisticated social engineering attacks, with the group responsible for a $263 million heist and extravagant spending of the proceeds. Meanwhile, Russian police dismantled a gang that used NFCGate-based malware to steal millions from bank customers by tricking victims into installing fake banking apps and harvesting card credentials for remote theft. A major international operation led by Europol and Eurojust dismantled a €700 million cryptocurrency scam network in Europe that used deepfake videos and aggressive marketing to lure victims into fake investment schemes. The network operated numerous fraudulent platforms, laundered funds through complex channels, and was taken down in coordinated raids across several countries, resulting in arrests and the seizure of cash, cryptocurrencies, and luxury items. These actions highlight the growing sophistication of cyber-enabled financial crime and the increasing collaboration between law enforcement agencies to disrupt such operations on a global scale.
Jun 29, 2026
Austrian and Albanian authorities, supported by **Europol** and **Eurojust**, dismantled a large online investment fraud operation that allegedly stole at least **€50 million** from victims across Europe and other regions. The network operated from call centers in **Tirana, Albania**, where investigators said it was run like a legitimate business with up to **450 employees** spanning management, finance, IT, HR, customer acquisition, and retention roles. Victims were lured through fake broker and cryptocurrency investment platforms promoted on search engines, websites, and social media, then pressured by multilingual operators posing as brokers or advisers to transfer more money. A coordinated action on **17 April** led to **10 arrests**, searches of **three call centers** and **nine homes**, and the seizure of **€891,735 in cash** along with hundreds of computers and phones. Investigators said the group used remote access software and an international money-laundering scheme to divert funds rather than invest them, and in some cases targeted victims a second time with a bogus recovery service that demanded a **€500** cryptocurrency payment. Authorities said the seized infrastructure and data are expected to support additional investigations in other affected countries.
Jul 3, 2026