Loading story…
Ukrainian authorities dismantled 94 fraudulent call centers in a nationwide operation involving the National Police of Ukraine, the Cyber Police Department, the Security Service of Ukraine, the Prosecutor General’s Office, and German law enforcement. Investigators carried out more than 400 searches—reported as 411 raids—and formally identified 26 suspects tied to schemes that targeted victims through fake banking, investment, and law-enforcement impersonation scams.
According to investigators, operators persuaded victims to hand over money, disclose banking access, or install remote-access software, while some operations also marketed bogus medical products. Police seized large quantities of computer equipment, phones, SIM cards, bank cards, cash, vehicles, gold, and tools used to access cryptocurrency wallets, and authorities are now conducting forensic analysis to identify victims, calculate losses, and build cases against organizers, money mules, and laundering networks.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
Police began forensic examinations of the seized equipment after the raids. Investigators said the analysis is intended to identify victims, determine the extent of losses, and gather evidence against organizers, money mules, and money launderers.
Authorities formally notified 26 individuals that they are suspects in the fraudulent call center scheme. The suspects may face charges under Parts 4 and 5 of Article 190 and Part 3 of Article 209 of the Criminal Code of Ukraine, carrying penalties of up to 12 years in prison and confiscation of property.
Ukrainian authorities, working with the Security Service of Ukraine, the Prosecutor General’s Office, and German police, shut down 94 fraudulent call centers involved in investment scams and schemes to gain access to victims’ bank accounts. The operation included 411 searches and seizures of cash, equipment, SIM cards, bank cards, cryptocurrency wallet access tools, vehicles, and gold.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
5 references tracked. Mallory keeps watching after this page renders.
cyberveille.ch
Open sourcescworld.com
Open sourcehelpnetsecurity.com
Open sourcebleepingcomputer.com
Open sourcecyberpolice.gov.ua
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
European law enforcement agencies, supported by Eurojust, have dismantled a large-scale fraud network operating multiple call centers in Ukraine that targeted victims across Europe. Authorities from Ukraine, the Czech Republic, Latvia, and Lithuania arrested 12 suspects and identified 45 individuals involved in the operation, which defrauded over 400 victims of more than 10 million euros. The criminal group used various schemes, including impersonating police officers and bank employees, convincing victims their accounts were compromised, and instructing them to transfer funds to "safe" accounts controlled by the network. In some cases, victims were persuaded to install remote access software, allowing the criminals to hijack their bank accounts, and some fraudsters even met victims in person to collect cash using stolen card details. The call centers, located in Dnipro, Ivano-Frankivsk, and Kyiv, employed around 100 people recruited from several European countries. Employees were paid commissions of up to 7% of the stolen funds and were promised bonuses such as cash, cars, or apartments for exceeding certain fraud targets, though these rewards were never distributed. During coordinated raids on December 9, 2025, authorities conducted 72 searches, seizing vehicles, weapons, computers, cash, and forged identification documents. The operation highlights the transnational nature of organized fraud and the effectiveness of coordinated law enforcement action across European borders.
Jun 29, 2026
Austrian and Albanian authorities, supported by **Europol** and **Eurojust**, dismantled a large online investment fraud operation that allegedly stole at least **€50 million** from victims across Europe and other regions. The network operated from call centers in **Tirana, Albania**, where investigators said it was run like a legitimate business with up to **450 employees** spanning management, finance, IT, HR, customer acquisition, and retention roles. Victims were lured through fake broker and cryptocurrency investment platforms promoted on search engines, websites, and social media, then pressured by multilingual operators posing as brokers or advisers to transfer more money. A coordinated action on **17 April** led to **10 arrests**, searches of **three call centers** and **nine homes**, and the seizure of **€891,735 in cash** along with hundreds of computers and phones. Investigators said the group used remote access software and an international money-laundering scheme to divert funds rather than invest them, and in some cases targeted victims a second time with a bogus recovery service that demanded a **€500** cryptocurrency payment. Authorities said the seized infrastructure and data are expected to support additional investigations in other affected countries.
Jul 3, 2026
European law enforcement reported multiple cyber-enabled fraud disruptions, including a Eurojust-supported operation that dismantled a **fraudulent call-centre network** operating from three offices in Dnipro. Authorities from Latvia, Lithuania, and Ukraine arrested **11 suspects**, seized **more than €400,000** in cash, and collected electronic evidence (computers, SIM cards, documents) during searches at **32 locations**. The group allegedly ran a fake cryptocurrency investment platform and used **remote access software** to gain access to victims’ online banking and move funds to accounts and crypto wallets under their control. Separately, Poland’s Central Bureau for Combating Cybercrime (CBZC) dismantled an organized group operating in Poland and Germany that used **phishing** to hijack Facebook accounts and extract **BLIK** payment codes. Investigators identified **11 group members**, placed **six** in pretrial detention, and seized **over 100,000** stolen Facebook credentials; prosecutors filed **400+ charges** including unauthorized access, online fraud, and money laundering. A South Korean case involving the breach of Seoul’s bike-hire service *Ttareungyi* (4.62 million users affected) is a distinct incident and not part of the European takedown actions described above.
Jun 29, 2026