A major international cybercrime operation led to the arrest of five Latvian nationals and the seizure of critical infrastructure used in large-scale cybercrimes across Europe. On October 10, 2025, law enforcement agencies in Latvia, Austria, Estonia, and Finland dismantled a criminal network responsible for defrauding thousands of victims through phishing, smishing, and other telecommunications-related crimes.
What Happened:
On October 10, 2025, a coordinated operation, codenamed ‘SIMCARTEL,’ took place across multiple countries, leading to the arrest of five cybercriminals and the seizure of numerous assets. Authorities in Latvia arrested two individuals, while three additional suspects were apprehended during the operation. Law enforcement officials carried out 26 searches, took down five servers, and seized 1,200 SIM-box devices along with 40,000 active SIM cards.
The operation revealed that the criminal network had orchestrated over 3,200 individual cyber fraud cases across Austria and Latvia, resulting in millions of euros in losses. Specifically, Austria reported losses of approximately EUR 4.5 million, while Latvia faced a financial hit of EUR 420,000. The group had been operating a sophisticated “crime-as-a-service” operation, offering clients access to SIM cards registered in over 80 countries. This enabled perpetrators to mask their identities while conducting various cybercrimes, including phishing, smishing, and fraud.
Who Was Behind the Network / Background of the Case:
The cybercriminal network, which operated under the alias ‘SIMCARTEL,’ had been active for several years, providing a range of telecommunications-based services that facilitated fraudulent activities. The network’s main innovation was offering a service that allowed individuals to rent phone numbers registered to people across the globe. This made it possible for perpetrators to carry out illegal activities while concealing their true identity and location.
This network was highly sophisticated, with accomplices acquiring SIM cards from nearly 80 countries and building a complex infrastructure to provide these services. Investigators discovered that over 49 million online accounts had been created using the network’s services, highlighting the vast scale of its operations.
Criminal Activities Enabled by the Network:
The network’s services were used to enable a multitude of serious crimes. These included:
- Phishing and Smishing: Cybercriminals used the rented phone numbers to impersonate trusted sources, stealing victims’ sensitive data like passwords, bank details, and credit card numbers, often leading to identity theft and financial loss.
- Fraud on Online Marketplaces: Criminals used fake accounts to defraud users on second-hand goods platforms, employing phishing and smishing tactics to deceive victims.
- Investment Scams: Perpetrators contacted victims, convincing them to invest large sums of money into fraudulent schemes. Often, they used remote access tools to gain control of the victim’s device.
- Daughter-Son Scam: Scammers posed as relatives of victims, usually via WhatsApp, claiming to be in emergency situations and demanding urgent payments.
- Fake Shops and Fake Bank Websites: Criminals used the network’s services to create fake e-commerce websites and fraudulent bank pages, tricking victims into providing sensitive financial information.
- Extortion and Migrant Smuggling: The network was also linked to more sinister activities, including extortion and migrant smuggling.
Criminal Sophistication and Technical Ingenuity:
The dismantled network demonstrated a high level of technical sophistication. Its online service featured a well-designed and professional appearance, providing users with a seamless experience to rent foreign phone numbers for illicit purposes. This technical infrastructure, including five servers, was seized during the operation, rendering the criminal network’s services unavailable.
The criminal mastermind behind the operation had been under investigation for other serious crimes, including arson and extortion, in Estonia. Law enforcement from Austria, Estonia, Latvia, and Finland, with support from Europol and Eurojust, coordinated the takedown, demonstrating the international scale of the operation.
Joint Investigative Effort:
The successful execution of ‘SIMCARTEL’ was the result of a highly collaborative effort among several countries and law enforcement agencies. Europol and Eurojust played a crucial role in facilitating the operation, providing technical support, and ensuring that law enforcement agencies had the necessary resources for the investigation.
In addition to tactical support on the ground, Europol and Eurojust helped coordinate the seizure of digital evidence, the takedown of criminal websites, and the dismantling of the infrastructure that supported the network’s activities. The seized websites, gogetsms.com and apisim.com, now display “splash pages” warning users that they have been shut down by law enforcement.
Results of the Action Day:
The operation led to significant results, including:
- 26 searches across multiple locations
- 5 cybercriminals arrested
- 1,200 SIM-box devices and 40,000 SIM cards seized
- Hundreds of thousands of additional SIM cards and luxury vehicles confiscated
- EUR 431,000 and USD 333,000 in suspects’ bank and crypto accounts frozen
Furthermore, law enforcement froze the suspects’ financial assets, including bank accounts and cryptocurrency holdings, in a bid to prevent further illegal activity and ensure that the proceeds of their crimes would not be accessed.
What Happens Next:
The dismantling of the ‘SIMCARTEL’ network has revealed the scale of cybercrime enabled by masking perpetrators’ identities through telecom infrastructure. While five suspects have been arrested, the full extent of the network’s operations is still being uncovered. Europol continues to monitor the situation, offering support to investigators as they continue to track down further criminal activity linked to the network.
The arrested individuals are expected to face serious charges, including fraud, identity theft, and involvement in organized crime. Their prosecution will likely provide further insights into how the criminal network operated and who else may have been involved.
Closing line:
This story may be updated with more information as it becomes available.
