Arrest

Ukraine’s cyberpolice has arrested members of a fraud gang that stole roughly $4,300,000 from over a thousand victims across the EU.

The crime group created over 100 fake “phishing” sites targeting users in France, Spain, Poland, the Czech Republic, Portugal, and other European countries, enticing them with products below market prices.

Orders placed by the victims didn’t correspond to actual purchases, while the threat actors stole credit card details they entered on the phony sites.

It is unknown how the victims arrived at these sites, but it could be via malvertizing, phishing emails, or even direct messages on social media platforms.

The fraudsters used the stolen data to make online purchases using other people’s credit cards. These goods are typically circulated through a network of resellers and money mules who help them launder the amounts.

The police say it located two call centers in Vinnytsia and Lviv, which supported the fraudulent operation by communicating with the customers to convince them to place orders.

Call center used in phishing operations
Call center used in phishing operations (cyberpolice.gov.ua)

The Ukrainian police have conducted over 30 searches on the members’ homes, call centers, and cars, confiscating computer equipment, mobile phones, and SIM cards for examination.

The law enforcement agency has also released the following video from the raids.

The Ukrainian police have conducted over 30 searches on the members’ homes, call centers, and cars, confiscating computer equipment, mobile phones, and SIM cards for examination.

The law enforcement agency has also released the following video from the raids.

The two arrests made in Ukraine are believed to involve organizers of the criminal gang, so the police detained them for interrogation.

The arrested individuals now face criminal charges based on part 4 of Article 190 (fraud) and part 1 of Article 255 (establishment, leadership of a criminal community or criminal organization, as well as participation in it).

These crimes incur a maximum penalty of 12 years in prison and confiscation of property.

Another ten members of the phishing gang were detained in other European countries, where they are being questioned.

Source: www.bleepingcomputer.com