Operation SIM Cartel
| Operation SIM Cartel | |
|---|---|
| Operation name | Operation SIM Cartel |
| Operation codename | SIMCARTEL |
| Type | Cybercrime infrastructure takedown |
| Scope | International |
| Participants | |
| Planned by | Europol, Eurojust |
| Executed by | Latvian State Police, Austrian and Estonian authorities, supported by the Shadowserver Foundation |
| Countries participating | Latvia, Austria, Estonia, Finland |
| No. of countries participating | 4 |
| Mission | |
| Target | Operators of the `gogetsms.com` and `apisim.com` infrastructure |
| Objective | Dismantle an international SIM farm and SIM-box cybercrime-as-a-service (CaaS) network |
| Method | Coordinated raids, server and website seizures, asset freezes, and arrests |
| Timeline | |
| Date executed | 2025 |
| Results | |
| Suspects | 7 |
| Arrests | 7 |
| Indictments | 3 (in Latvian spin-off case) |
| Miscellaneous results | Dismantling of a network hosting over 40,000 active SIM cards, linked to 49 million fake accounts and 3,200 fraud cases; seizure of 1,200 SIM boxes, €1.2 million in cash, and €266,000 in cryptocurrency. |
Operation SIM Cartel (also styled as Operation SIMCARTEL) was an international law enforcement operation conducted on 10 October 2025 that dismantled an industrial-scale SIM farm and SIM-box network based primarily in Latvia.[1] Coordinated by Europol and Eurojust, the joint investigation involved law enforcement agencies from Latvia, Austria, Estonia, and Finland.[2]
The criminal network operated a cybercrime-as-a-service (CaaS) platform that allowed actors globally to rent anonymous phone numbers to register and verify fake accounts on popular online services. The infrastructure powered an estimated 49 to 50 million fake accounts and was linked to at least 3,200 confirmed fraud incidents, causing approximately €5 million in financial losses across Europe.[2][3]
Background and infrastructure
[edit]A SIM box (or SIM farm) holds dozens or hundreds of cellular SIM cards and routes telecommunication traffic. While used for legitimate routing purposes, they are frequently exploited by cybercriminals to bypass international call rates or to generate mass automated text messages anonymously.[4]
The criminal syndicate targeted in Operation SIM Cartel operated under the guise of legitimate businesses. They hosted a platform that offered automated verification services using phone numbers registered in more than 80 countries.[2] These services were primarily facilitated through two public-facing websites, gogetsms.com and apisim.com.[4]
Clients of the service paid to receive SMS verification codes, which were then used to bypass security measures and create millions of fraudulent, automated accounts across more than 160 online platforms, including social media, financial services, and messaging applications.[5]
Law enforcement action
[edit]On 10 October 2025, authorities conducted a coordinated "action day" consisting of 26 searches across various properties in Latvia.[2] The tactical execution inside Latvia was carried out by the Latvian State Police's Cybercrime Enforcement Department in cooperation with the "OMEGA" counter-terrorism unit.[6] Technical and investigative assistance was also provided by the Shadowserver Foundation.[4]
During the raids, law enforcement seized:[2][5]
- 1,200 active SIM box devices
- Approximately 40,000 active SIM cards and hundreds of thousands of inactive/spare SIM cards
- Five infrastructure servers
- Over €1.2 million in physical cash
- Four luxury vehicles and a motorcycle
The domains gogetsms.com and apisim.com were seized and replaced with law enforcement landing pages.[2]
Seven suspects were arrested, including five Latvian nationals detained during the primary raids. One of the main suspects arrested in Estonia was already under investigation by Estonian authorities for separate counts of arson and extortion.[1] In addition to the physical seizures, authorities froze approximately €431,000 in traditional bank accounts and €266,000 in various cryptocurrency accounts.[5]
Impact
[edit]The dismantled SIM-box network was linked to at least 3,200 cyber fraud incidents across Europe, which included phishing, smishing (SMS phishing), investment scams, impersonation fraud, and extortion.[2][4]
The cumulative financial damage caused by these scams is estimated to be approximately €5 million. The majority of the documented losses were concentrated in Austria (approximately €4.5 million) and Latvia (approximately €420,000).[1][2]
Legal proceedings
[edit]Following the October 2025 raids, a Joint Investigation Team (JIT) composed of Latvian, Austrian, and Estonian investigators continued forensic analysis of the seized servers to identify the global clientele of the platform.[7]
On 14 July 2026, the Latvian State Police announced they had finalized their pre-trial investigation into a spin-off criminal case regarding money laundering and the unauthorized use of third-party identities.[8] The investigation revealed that members of the criminal organization had stolen or unlawfully acquired the personal credentials, emails, and identification documents of third parties to register multiple virtual currency accounts and debit cards.[8]
These proxy accounts were utilized by the group's leader to launder cryptocurrency totaling over €1,497,062.[8][7] On 8 June 2026, the Rīga District Prosecutor's Office referred the case against three individuals to the Economic Affairs Court (Ekonomisko lietu tiesa).[7] Because the exact predicate offenses generating the funds could not be entirely traced during this branch of the inquiry, the prosecution proceeded under "stand-alone" autonomous money laundering laws.[8]
See also
[edit]References
[edit]- 1 2 3 "Cybercrime-as-a-service takedown: 7 arrested". Europol. 17 October 2025. Retrieved 14 July 2026.
- 1 2 3 4 5 6 7 8 Toulas, Bill (17 October 2025). "Europol dismantles SIM box operation renting numbers for cybercrime". Bleeping Computer. Retrieved 14 July 2026.
- ↑ "Latvian police have arrested more than 200 phone scammers over two years". Latvian Public Broadcasting (LSM). 18 February 2026. Retrieved 14 July 2026.
- 1 2 3 4 "Europol Dismantles SIMCARTEL SIM Box Network Used for Mass Fake Account Creation and Global Cybercrime". Rescana. 19 October 2025. Retrieved 14 July 2026.
- 1 2 3 "In an international operation "SIMcartel", the State Police dismantles IT infrastructure used for online fraud; five Latvian nationals arrested". State Police of Latvia. 17 October 2025. Retrieved 14 July 2026.
- ↑ "Kiberlaikapstākļi 2025 | OKTOBRIS". CERT.lv. 6 November 2025. Retrieved 14 July 2026.
- 1 2 3 "Tiesās trīs personas par noziedzīgi iegūtu līdzekļu legalizēšanu gandrīz 1,5 miljonu eiro apmērā". Latvian Public Broadcasting (LSM). 14 July 2026. Retrieved 14 July 2026.
- 1 2 3 4 "Operācija "SIM Cartel": Valsts policija apturējusi organizētu grupu, kas izmantoja citu personu identitātes vairāk nekā 1,4 miljonu eiro legalizēšanai". State Police of Latvia. 14 July 2026. Retrieved 14 July 2026.