International ‘cybercrime consultancy’ gang busted in the Malaga town of Benalmadena

Four individuals arrested in the Malaga municipality of Benalmadena were allegedly operating an international ‘cybercrime consultancy’.

As reported by the National Police in a statement on Friday, April 21, four people were arrested in Malaga for allegedly belonging to a criminal organisation. The gang is thought to have been operating an international ‘cybercrime consultancy’.

Through this system, they are suspected of supplying other groups with a wide range of forged documents for committing fraud on the internet.

An investigation by the force determined that the gang operated as a cybercrime consultancy for other organisations, mainly of sub-Saharan origin. Among those arrested is the leader, a ‘reference forger’ of Cameroonian origin with extensive knowledge of computers and online banking.

“He had turned his home in Benalmádena into a laboratory for the mass falsification of physical and virtual documents, using specialised equipment, and the production of 1,400 fraudulent NIE documents”, explained the Provincial Police.

The network not only operated as a cybercrime consultancy though. It was also directly involved in cyber-attacks, and, ultimately, money laundering, which gave the scheme a comprehensive nature.

So far, a total of 108 frauds have been attributed to the gang, committed through new technologies. These included the operation of a dozen ‘love scams’, five scams involving fake lottery prizes and fake inheritances from an unknown relative, and almost a hundred man-in-the-middle frauds.

Investigators also uncovered another important person within the scheme. This was a person of Nigerian origin who was in charge of recruiting the mules and providing them with the ‘laundering kits’.

These generally included a forged NIE document, a bank account opened in the name of the former, an online banking password, and a phone card in the name of a non-existent person. The recruiter also paid commissions to the mules and manipulated the money they withdrew from ATM cash machines.

The profits obtained by the organisation amounted to around €2 million, with another €108,556 blocked in 144 of the network’s bank accounts.

To launder the money, the network made use of financial mules, people who, in exchange for a commission of €600 on average, extracted the money from the cyber-scams at ATM cash points or opened accounts with which to launder the defrauded money through online banking.

‘Operation Mogador’ began several months ago when a financial mule was detected in a cash machine in the capital of Malaga. They were preparing to withdraw money from a bank account to which €13,000 had been swindled from a company in the food sector, using the man-in-the-middle method.

In this case, a supplier of the swindled company had been infected with Trojan-type malware. This software allowed the cybercriminals to take control of the supplier’s email address and subsequently send a fake email with changed account details so that the food business would pay the criminal network instead of the distributor.

Due to this initial action, the police arrested the mule, a 31-year-old Nigerian man whose phone was found to have files on it. The most important of these files was a photograph of two brides and grooms next to a wedding cake.

They turned out to be the ringleader of the network and his wife, both investigated using a combination of traditional investigative techniques and other more modern techniques in the fight against cybercrime.

The main suspect, based in Benalmádena, had been a bank worker in Cameroon. When the officers went to the house to arrest and search him, the main suspect was using the computer equipment through a VPN connection to the internet, a legal service widely used by cybercriminals that facilitates anonymity.

Numerous and relevant documentary and computer material for counterfeiting was seized. These included multifunction printers and screen printers, die-cutting machines, laminating machines, laptops, hard disks, mobile phones, dozens of telephone cards, so-called laundering kits, counterfeit documentation and a huge quantity and variety of digital documents.

In raw form, more than 759 gigabytes of information in the form of 1,200,000 files from which thousands of forged documents were extracted. These included more than 1,400 NIE documents; numerous DNI (National Identity Cards); and many more.

There were also 400 NIE documents; numerous forged DNI documents, as well as the templates for their preparation. Another 368 identity documents for foreigners were discovered, along with census certificates, work-life certificates, work contracts and invoices, COVID certificates, and other certificates and documents that they used in their own scams or that they sold to other related organisations.

ID photos and logos of public administrations were also found, plus Spanish lottery tickets, bar associations, and a large number of companies.

108 victims have already been traced in Spain, Germany, Switzerland, Austria, Italy, Luxembourg, Slovenia and Poland. Among the victims is a woman who transferred more than €70,000 to the organisation’s accounts in 20 days after falling in love with a fake UN doctor on a humanitarian mission to Ukraine.

The number of victims could eventually be much higher, as the dismantled network used computer tools for the mass launching of attacks – SPAM. Investigators intercepted files in the possession of the plot with mailing lists of more than 1,500,000 potential victims, as reported by laopinindemalaga.es.