Colin Thierry
Published on: November 30, 2022
Spanish National Police shut down a cybercrime organization on Tuesday that used fraudulent investment sites to steal over €12.3 million ($12.8 million) from 300 victims across Europe.
The threat actors would create fake cryptocurrency investment sites with a similar appearance to well-known, legitimate platforms in order to deceive their victims.
They then laundered the money they stole by moving it from Spanish banks to foreign financial entities where the criminals hoped it was away from the authorities’ scrutiny or tracing ability.
Spanish law enforcement launched their investigation after the legal representative of one of the impersonated financial groups reported the issue to the police.
Following the investigation, six members of the cybercrime organization were arrested in Madrid and Barcelona and face charges of suspected fraud, money laundering, and usurpation of marital status.
Victims would usually end up on the fraudulent sites by following links embedded in phishing emails. The threat actors targeted victims in several countries in Europe, but mainly went after French citizens and impersonated French financial institutions.
The victims were falsely told that they were investing money in these websites, but instead had their funds directly sent to the cybercriminals’ bank accounts.
“The method of defrauding used by the criminal group consisted of offering any potential client, through fraudulent websites, the possibility of carrying out different financial operations, such as: contracting investment products (variable income, futures, and cryptocurrencies) and contracting financing products,” the Spanish police said in a Google-translated statement on Tuesday.
The extracted funds were moved to the threat actors’ bank accounts in Spain, Portugal, Poland, and France before being laundered through foreign entities. After transferring funds around to cover their tracks, the cybercriminals eventually move them back to their Spanish accounts.
The Spanish police’s investigation determined the total amount of money sent to the cybercriminals’ final destination was €12,345,731 ($12.8 million).
