An action day performed in Latvia on 10 October 2025 led to the arrest of five cybercriminals of Latvian nationality and the seizure of infrastructure used to enable crimes against thousands of victims across Europe.
During the operation codenamed ‘SIMCARTEL’, law enforcement arrested two further suspects, took down five servers and seized 1 200 SIM box devices alongside 40 000 active SIM cards. Investigators from Austria, Estonia and Latvia, together with their colleagues at Europol und Eurojust, were able to attribute to the criminal network more than 1 700 individual cyber fraud cases in Austria and 1 500 in Latvia, with a total loss of several million euros. The financial loss in Austria alone amounts to around EUR 4.5 million, as well as EUR 420 000 in Latvia.
Read more…
Source: Europol
Sign up for the Cyber Security Review Newsletter
The latest cyber security news and insights delivered right to your inbox
Related:
- Donut extortion group also targets victims with ransomware
November 22, 2022
The Donut (D0nut) extortion group has been confirmed to deploy ransomware in double-extortion attacks on the enterprise. BleepingComputer first reported on the Donut extortion group in August, linking them to attacks on Greek natural gas company DESFA, UK architectural firm Sheppard Robson, and multinational construction company Sando. Strangely, the data for Sando and DESFA was also posted ...
- Suspected Zeus cybercrime ring leader ‘Tank’ arrested by Swiss police
November 16, 2022
Vyacheslav Igorevich Penchukov, also known as Tank and one of the leaders of the notorious JabberZeus cybercrime gang, was arrested in Geneva last month. The Swiss Federal Office of Justice (FOJ) said Penchukov was arrested last month and is waiting to be extradited to the United States, although he can still appeal FOJ’s decision. “By order of ...
- DTrack activity targeting Europe and Latin America
November 15, 2022
DTrack is a backdoor used by the Lazarus group. Initially discovered in 2019, the backdoor remains in use three years later. It is used by the Lazarus group against a wide variety of targets. For example, Kaspersky researchers seen it being used in financial environments where ATMs were breached, in attacks on a nuclear power ...
- Ukraine says Russian hacktivists use new Somnia ransomware
November 12, 2022
Russian hacktivists have infected multiple organizations in Ukraine with a new ransomware strain called ‘Somnia,’ encrypting their systems and causing operational problems. The Computer Emergency Response Team of Ukraine (CERT-UA) has confirmed the outbreak via an announcement on its portal, attributing the attacks to ‘From Russia with Love’ (FRwL), also known as ‘Z-Team,’ whom they track ...
- Europe calls for joint cyber defense to ward off Russia
November 11, 2022
The European Commission on Thursday proposed a cyber defense policy in response to Europe’s “deteriorating security environment” since Russia illegally invaded Ukraine earlier this year. The Commission, citing recent cyber attacks on energy networks, transportation infrastructure and space assets, called on member states to “significantly increase” investments in cybersecurity capabilities. It also aims to boost defense ...
- Hack the Real Box: APT41’s New Subgroup Earth Longzhi
November 9, 2022
In early 2022, Trend Micro investigated an incident that compromised a company in Taiwan. The malware used in the incident was a simple but custom Cobalt Strike loader. After further investigation, however, we found incidents targeting multiple regions using a similar Cobalt Strike loader. While analyzing code similarities and tactics, techniques, and procedures (TTPs), we ...