Authorities Shut Down Cybercrime-as-a-Service, Seize 40,000 SIM Cards
Law enforcement authorities in Europe have dismantled a cybercrime-as-a-service operation, facilitating widespread fraud and other serious offenses across the continent.
Law enforcement authorities in Europe have dismantled a cybercrime-as-a-service operation, facilitating widespread fraud and other serious offenses across the continent.
The coordinated operation, codenamed 'SIMCARTEL', led to seven arrests, the seizure of over 40,000 active SIM cards , and the dismantling of infrastructure responsible for millions of euros in damages.
Massive Criminal Infrastructure Uncovered
On October 10, 2025, the operation in Latvia resulted in five Latvian nationals being arrested and the seizure of significant criminal infrastructure.
Authorities confiscated approximately 1,200 SIM box devices with 40,000 active SIM cards and several hundred thousand additional SIM cards.
Additional seizures included five servers, control of two illicit websites, and the freezing of EUR 431,000 in bank accounts and USD 333,000 in cryptocurrency.
26 searches conducted across various locations. 7 arrests, including 5 Latvian nationals. 1,200 SIM box devices seized operating 40,000 active SIM cards. 5 servers hosting criminal infrastructure dismantled. EUR 431,000 in bank accounts and USD 333,000 in cryptocurrency frozen. 4 luxury vehicles confiscated.
The network provided sophisticated online services through websites offering telephone numbers from over 80 countries. These numbers were rented to criminals for creating fake accounts, concealing identities while committing cybercrimes.
On October 10, 2025, the operation in Latvia resulted in five Latvian nationals being arrested and the seizure of significant criminal infrastructure.
The network is linked to over 1,700 cyber fraud cases in Austria and 1,500 in Latvia, with financial losses of approximately EUR 4.5 million in Austria and EUR 420,000 in Latvia.
Over 49 million online accounts were created using the illegal service.
Criminal activities enabled by the service:
Phishing and smishing attacks targeting banking credentials. Fake WhatsApp scams demanding urgent payments. Investment fraud schemes using remote-access software. Fake online marketplaces and fraudulent bank websites. Impersonation of police officers targeting Russian-speaking victims. Distribution of child sexual abuse material.
The service facilitated various criminal activities, including phishing, smishing, investment fraud, and fake marketplace scams. It was used for WhatsApp scams, fake shop websites, police impersonation, and other serious crimes, including migrant smuggling and distribution of child sexual abuse material.
International Cooperation Brings Results
The operation was a collaborative effort between authorities from Austria, Estonia, Latvia, and Finland, with support from Europol and Eurojust.
During the action day, law enforcement conducted 26 searches and seized four luxury vehicles in addition to the digital infrastructure.
Europol deployed specialists to Riga and worked with the Shadowserver Foundation to dismantle the technical infrastructure, displaying notifications on the criminal service websites.
The investigation continues as authorities work to uncover the full extent of the network's activities and identify additional perpetrators.
Based on reporting by GBHackers.