The Spanish National Police have dismantled a cybercrime group accused of engaging in large-scale cyberMisanism – the theft and monetization of data from more than four million victims. As part of a special operation, the police conducted 16 searches in various locations across the country, including Madrid, Malaga, Welva, Alikante, and Mursia. This resulted in the arrest of 34 individuals. During the raids, authorities seized firearms, cold weapons, four high-end vehicles, 80,000 euros in cash, and computers containing crucial evidence.
According to the police, the criminals employed phishing attacks through email and SMS, pretending to be representatives of harmless organizations such as delivery services or energy companies. They also frequently used a tactic known as “Son in Distress,” where scammers would call parents and claim that their child was in danger.
The group employed various tactics and had numerous accomplices, including insiders in major technology companies who helped change the recipient and address of deliveries for expensive goods. The group’s diverse strategies and goals made it challenging to connect all the criminal activities.
The investigation into the group began in early 2023 after receiving thousands of complaints from victims. The fraudsters hacked into the databases of financial institutions and fraudulently credited funds to customer accounts. They would then contact these clients, alleging that the money had been mistakenly transferred and must be returned.
In order to facilitate the “return,” victims were instructed to follow a link to a phishing page that closely resembled the official website of the bank. On this fraudulent page, victims would enter their account information, unknowingly providing it to the attackers.
Estimates suggest that the group managed to accumulate a total of three million euros through this scheme. To make the movement of funds more difficult to trace, the funds were converted into cryptocurrency.
The leaders of the cybercrime group are now in custody, and investigators will continue their work to identify other participants in the coming months.