POLICE DISMANTLE PROLIFIC RANSOMWARE CYBERCRIMINAL NETWORK
2013/2/13 [Europol press releases]
Spanish Police, working closely with the European Cybercrime Centre (EC3) at Europol, have dismantled the largest and most complex cybercrime network dedicated to spreading police ransomware. It is estimated that the criminals affected tens of thousands of computers worldwide, bringing in profits in excess of one million euros per year.
Operation Ransom resulted in 11 arrests – the first was a 27-year-old Russian, responsible for the creation, development and international distribution of the various versions of the malware. He was arrested in the United Arab Emirates and is currently awaiting extradition to Spain. Furthermore, one of the criminal network’s largest financial cells in the Costa del Sol was dismantled. Spanish Police also arrested another 10 individuals linked to the financial cell: six Russians, two Ukrainians and two Georgians.
Six premises were searched in the province of Málaga, where IT equipment used for the criminal activities was confiscated. In addition, investigators seized credit cards used to cash out the money that victims paid via Ukash, Paysafecard and MoneyPak vouchers, as well as around 200 credit cards which were used to withdraw €26 000 in cash prior to the arrests.
The financial cell of the network specialised in laundering the proceeds of their crimes, obtained in the form of electronic money. For this, the gang employed both virtual systems for money laundering and other traditional systems using various online gaming portals, electronic payment gateways or virtual coins. They also used compromised credit cards to extract cash from the accounts of ransomware victims via ATMs in Spain. As a final step, daily international money transfers through currency exchanges and call centres ensured the funds arrived at their final destination in Russia.
Police ransomware is a type of malware that blocks the computer, accusing the victims of having visited illegal websites containing child abuse material or file sharing, and requests the payment of fine to unblock it. By dressing the ransomware up to look as if it comes from a law enforcement agency, cybercriminals convince the victim to pay the ‘fine’ of €100 through two types of payment gateways - virtual and anonymous - as a penalty for the alleged offence. The criminals then go on to steal data and information from the victim’s computer. Since the virus was detected in May 2011, there have been more than 1200 reported cases just in Spain, and the number of victims could be much higher.
Operation Ransom was led by the Spanish Police (Technological Investigation Squad of the Central UDEF, part of the General Commissariat of the Judicial Police, with the cooperation of the Provincial Police Station and the GOES from Costa del Sol -SPANISH NATIONAL POLICE-.) and coordinated by Europol and Interpol. Other crucial partners included Eurojust, the attachés of the Ministry of Interior of the Spanish Embassy in Moscow and the Spanish Embassy in the UAE.
For advice on how to prevent becoming a victim of police ransomware, please read our Tips & advice to prevent police ransomware infecting your computer brochure.
-----
POLICE BUST INTERNATIONAL DRUGS-TRAFFICKING RING, SEIZING OVER 2.5 TONNES OF CANNABIS
2013/02/08 [Europol press releases]
Law enforcement authorities in Germany and Spain, supported by Europol, have successfully broken up an international cannabis-trafficking network based in Almería, Spain.
On the afternoon of 6 February, Spanish National Police(Organised Crime and Drug Trafficking Central Unit (UDYCO)) investigators arrested five key suspects, who were caught red-handed after loading a German-registered trailer truck with 88 bundles of hashish, bound for northern Europe. The bundles of cannabis seized ranged in weight from 25–30 kgs each, totalling around 2.6 tonnes. The estimated price of the seized drugs on the illegal market is approximately 4 million euros. The drugs were concealed in a warehouse located between Murcia and Almería.
Two of those arrested are father and son of Dutch nationality, two are Spanish nationals and one an Irish citizen. An additional suspect, currently at large, escaped.
This operation saw close and intense cooperation between Europol and law enforcement units in Germany and Spain. The joint international operation has led to the disclosure of a multi-nationally structured and active organised criminal group involved in the wholesale trafficking of illegal drugs hidden in legal cargo. Evidence suggests that the road haulage companies used are directed by members of the criminal group.
The operation fits into, and is the outcome of, a much wider international law enforcement action involving two criminal investigations that have been running over recent months respectively in Germany (Driven by Germany’s LKA Hannover (State Office of Criminal Investigation) and ZFA Hannover (Department of Customs Investigation)) and Norway, (Driven by Oslo Police District with assistance from Oslo Customs Region.) with the cooperation of investigators from Denmark, the Netherlands, Sweden and the United Kingdom, and supported by Europol.
The entire multi-agency operation was facilitated, from the very beginning, by Europol and Europol Liaison Officers from the involved countries, which ensured fast and effective cooperation and sharing of intelligence via Europol’s Secure Information Exchange Network Application (SIENA). In addition Europol provided timely and effective operational analysis reporting, as well as providing the necessary financial support and facilities to allow law enforcement investigators to hold crucial operational meetings.
-----
EUROPOL SUPPORTS INVESTIGATION INTO TERRORIST ATTACK AT BURGAS AIRPORT, BULGARIA
2013/02/05 [Europol press releases]
Today Bulgarian authorities reported on their investigation into a bomb explosion that took place outside Burgas airport on 18 July 2012. Five Israeli tourists were killed in the attack, as well as the Bulgarian driver of the bus and the alleged perpetrator. Europol is pleased to confirm details of its substantial contribution to the investigation.
The Bulgarian authorities requested Europol’s assistance in the immediate aftermath of the explosion. A Europol bomb-scene investigator, with access to a European network of similar experts and the European Bomb Database System hosted by Europol, attended the scene the following morning to assist with the forensic examination. Further support was provided at the scene by Europol’s forensic document examiners, and by a team of experts based at the agency’s headquarters in The Hague. This generated significant investigative leads, enabling the Bulgarian authorities to make rapid progress in this case.
Early assumptions in the investigation were that the attack was the work of a suicide bomber. But analysis of the bomb scene evidence by the Europol expert, including shrapnel from the improvised explosive device (IED), proved otherwise. It confirmed that the device had been remotely detonated and strongly suggested, therefore, that more than one person was responsible for the attack.
Meanwhile, forensic and technical examination of identity documents linked to the investigation led Europol to establish that a US driving license recovered at the crime scene and another recovered elsewhere in Bulgaria were both counterfeits from the same source, located in Lebanon. This discovery was of major importance to the investigation.
The Bulgarian authorities used Europol’s secure communications network as a platform for the exchange of intelligence with other countries throughout this investigation. This allowed Europol to provide analytical support to the Bulgarian investigative team, checking and analysing large amounts of data, and helping to identify potential suspects.
With the assistance of Europol and a number of other international partners the Bulgarian authorities have made substantial progress in the investigation, leading them to uncover the identity of the suspects and their possible link to Hezbollah. Although a final determination of responsibility has not been made Europol’s findings in the case are consistent with this view.
In light of these findings, Europol is assessing the impact of the incident on the threat of international terrorism in the EU.
-----
RESULTS FROM THE LARGEST FOOTBALL MATCH-FIXING INVESTIGATION IN EUROPE
2013/02/04 Europol Press Release
A major investigation involving Europol and police teams from 13 European countries has uncovered an extensive criminal network involved in widespread football match-fixing. A total of 425 match officials, club officials, players, and serious criminals, from more than 15 countries, are suspected of being involved in attempts to fix more than 380 professional football matches. The activities formed part of a sophisticated organised crime operation, which generated over €8 million in betting profits and involved over €2 million in corrupt payments to those involved in the matches.
The Joint Investigation Team (JIT), codenamed Operation VETO, ran between July 2011 and January 2013. Led by Europol, Germany, Finland, Hungary, Austria and Slovenia, it was also supported by Eurojust, Interpol and investigators from eight other European countries. The investigation coordinated multiple police enquiries across Europe and was facilitated by intelligence reports from Europol, based on the analysis of 13,000 emails and other material, which identified links between matches and suspects and uncovered the nature of the organised crime network behind the illegal activities. The investigation has since led to several prosecutions in the countries involved, including Germany where 14 persons have already been convicted and sentenced to a total of 39 years in prison.
“This is a sad day for European football and more evidence of the corrupting influence in society of organised crime. But this investigation also proves the value of international police cooperation in fighting back against the criminals involved. Europol and its law enforcement partners are committed to pursuing serious criminals wherever they operate. Unfortunately this also now includes the world of football, where illegal profits are made on a scale and in a way that threatens the very fabric of the game. All those responsible for running football should heed the warnings found in this case,” says Rob Wainwright, Director of Europol. He also confirmed that he will be sharing the results of the investigation with UEFA President, Michel Platini.
Among the 380 or more suspicious matches identified by this case are World Cup and European Championship qualification matches, two UEFA Champions League matches and several top-flight matches in European national leagues. In addition another 300 suspicious matches were identified outside Europe, mainly in Africa, Asia, South and Central America.
“We have evidence for 150 of these cases and the operations were run out of Singapore with bribes of up to 100 000 euros paid per match. Even two World Championship Qualification matches in Africa, and one in Central America, are under suspicion,” says Fridhelm Althans from Bochum Police, Germany, and a spokesman for JIT Veto. This information will be shared with Interpol for further action in the context of its long-term efforts to work with a broad community around the world to crack down on this problem.
“Match fixing is a global issue requiring strong partnerships at the national, regional and international levels not only to target and dismantle the criminal networks making millions in illicit profits, but also to implement training programmes to better protect all those involved in football,” said Mr Gianni Baldi, Head of Interpol’s Drugs and Organized Crime Unit.
The organised criminal group behind most of these activities has been betting primarily on the Asian market. The ringleaders are of Asian origin, working closely together with European facilitators. During the investigation, links were also found to Russian-speaking and other criminal syndicates.
The international nature of match-fixing, exposed in this case, presents a major challenge to investigators and prosecutors. One fixed match can involve up to 50 suspects in 10 countries, spanning different legal frameworks and definitions of match-fixing and betting fraud.
Ms Michèle Coninsx, President of Eurojust, commented: “International cooperation was the key to the success of this challenging cross-border case, involving more than 30 countries. Coordination meetings at Eurojust, including video conferences with Asian counterparts, facilitated the opening of new investigations and the resolution of complex judicial issues. Eurojust provided access to funding for JIT Veto, one of the largest JITs in history.” The successful outcome of JIT Veto proves both the added value of Eurojust and the JIT Funding Project, which in 2012 financed 62 different JITs involving 22 Member States.
JIT Veto investigations are still ongoing.
-----
MAJOR PEOPLE SMUGGLING CRIMINAL NETWORK DISMANTLED ACROSS EUROPE - 103 SUSPECTS ARRESTED
2013/01/30 [Europol press releases]
Yesterday, 29 January 2013, a total of 103 persons suspected of being part of a people-smuggling network were arrested throughout Europe. 10 European countries and EULEX (European Union Rule of Law Mission in Kosovo) were involved in the common action supported and coordinated by Europol.
In the early hours the suspects were arrested in Croatia, Czech Republic, France, Germany, Greece, Hungary, Poland, Slovak Republic, Turkey and Kosovo region. Other coercive measures were carried out in Switzerland; Austria also supported the common action.
All arrested persons are suspected of being involved in the clandestine smuggling of a large number of irregular migrants into and within the European Union mainly via Turkey and the Western Balkan region.
The irregular migrants were recruited mainly in Afghanistan, Iraq, Pakistan, Syria and Turkey by the criminal network, which was using various modi operandi to smuggle them into and within the EU. The migrants were often smuggled in inhuman and dangerous conditions, such as in very small hidden compartments in the floor of buses or trucks, in freight trains or on boats. In some cases falsified travel documents were used by the migrants. Marriages of convenience were also used as a modus operandi to regularise their status in the EU.
This is one of the largest co-ordinated actions against people smugglers made at a European level, involving more than 1200 police officers.
In total 117 house searches and searches of other properties were carried out. During the searches, mobile telephones, laptops, bank statements, a semi-automatic rifle with a large amount of ammunition and more than 176 500 EUR in cash were seized.
In September 2011 Austria and Hungary launched a joint response to the significant increase in illegal immigration into their countries by establishing Project FIMATHU (Facilitated Illegal Immigration Affecting Austria and Hungary). As a result, over 7.500 irregular migrants have been apprehended and 891 smuggling incidents identified in total in the two countries. The successful results have meant that interest in the project has grown and there are 10 new members of the project, namely: Bulgaria; Croatia; Czech Republic; Germany; Poland; Romania; Serbia; Slovakia, Slovenia and Switzerland. Recently Bosnia and Herzegovina and EULEX have also been invited to join the project. The common goal of the Project FIMATHU is to disrupt and dismantle the illegal immigration networks operating via the Western Balkans as well as in other European countries.
Europol supported the investigations by facilitating the information exchange amongst the respective countries and by providing operational analysis and other operational support throughout the investigation. Within the Project FIMATHU all relevant criminal intelligence has been shared with Europol, including data extracted from over 500 seized mobile phones. Europol has been processing and analysing the data to find important links between Austria, Hungary and the source and transit countries, and to identify the criminal networks organising the illegal immigration.
During the common action day Europol deployed one mobile office to Germany to support the operation with on-the-spot analysis. The International Coordination Centre was set up at Europol and was staffed by senior investigators from those countries in which arrests took place to coordinate the pan-European action and to conduct cross-checking and provide analysis of the data generated.
| < Prec. | Succ. > |
|---|