Europol Dismantles SIMCARTEL Network Behind Global Phishing and SIM Box Fraud Scheme  Europol has taken down a vast international cybercrime network responsible for orchestrating large-scale phishing, fraud, and identity theft operations through mobile network systems. The coordinated crackdown, codenamed “SIMCARTEL,” led to multiple arrests and the seizure of a massive infrastructure used to fuel telecom-based criminal activity across more than 80 countries.  Investigators from Austria, Estonia, and Latvia spearheaded the probe, linking the criminal network to over 3,200 cases of fraud, including fake investment scams and emergency call frauds designed for quick financial gain. The financial toll of the operation reached approximately $5.3 million in Austria and $490,000 in Latvia, highlighting the global scale of the scheme.  The coordinated action, conducted primarily on October 10 in Latvia, resulted in the arrest of seven suspects and the seizure of 1,200 SIM box devices loaded with nearly 40,000 active SIM cards. Authorities also discovered hundreds of thousands of unused SIM cards, along with five servers, two websites, and several luxury vehicles. Around $833,000 in funds across bank and cryptocurrency accounts were also frozen during the operation.  According to Europol, the infrastructure was designed to mask the true identities and locations of perpetrators, allowing them to create fake social media and communication accounts for cybercrimes. “The network enabled criminals to establish fraudulent online profiles that concealed their real identity and were then used to carry out phishing and financial scams,” Europol said in a statement.  Investigators have traced the network to over 49 million fake accounts believed to have been created and distributed by the suspects. These accounts were used in a range of crimes, including extortion, smuggling, and online marketplace scams, as well as fake investment and e-commerce schemes.  The operation highlights the growing global threat of SIM farms—collections of SIM boxes that allow cybercriminals to automate scams, send spam, and commit fraud while remaining undetected by telecom providers. These systems have become a preferred tool for large-scale phishing and social engineering attacks worldwide.  Just weeks earlier, the U.S. Secret Service dismantled a similar network in New York City, seizing over 300 servers and 100,000 SIM cards spread across several locations.  Cybersecurity intelligence firm Unit 221B also issued a warning that SIM farms are rapidly multiplying and putting telecom providers, banks, and consumers at risk. “We’ve identified at least 200 SIM boxes operating across dozens of U.S. sites,” said Ben Coon, Chief Intelligence Officer at Unit 221B.  While the SIMCARTEL takedown marks a major victory for law enforcement, Europol noted that investigations are still underway to uncover the full extent of the criminal infrastructure. Authorities emphasize that combating SIM box networks is essential to defending users against phishing, identity fraud, and telecom-based cyberattacks that continue to grow in sophistication and scale.

Europol Dismantles SIMCARTEL Network Behind Global Phishing and SIM Box Fraud Scheme #CyberSecurity #cybercriminalgroup #Europol

Qilin Ransomware Gang Claims Cyberattack on Japanese Beer Giant Asahi  The Qilin ransomware group has claimed responsibility for the recent cyberattack on Japanese brewing giant Asahi, adding the company’s name to its dark web data leak site. The cybercriminals alleged that they had stolen over 9,300 files amounting to 27GB of confidential data, including financial documents, employee identification records, contracts, and internal reports. To substantiate their claims, the group published 29 images showing snippets of the stolen files.  Asahi, Japan’s largest beer manufacturer, employs around 30,000 people and produces approximately 100 million hectoliters annually, generating close to $20 billion in revenue. The company suffered significant operational disruptions following the attack. On September 29, Asahi temporarily halted production at six of its domestic facilities, later confirming on October 3 that a ransomware attack had crippled its systems and led to data exfiltration.  At first, no threat actor took public credit for the breach. However, the Qilin ransomware group eventually listed Asahi among its victims, likely after ransom negotiations failed. Qilin, which emerged in 2023, is known as a multi-platform ransomware operation capable of targeting both Windows and Linux systems. The group has been associated with other notorious hacker collectives such as Scattered Spider and, more recently, North Korean state-linked actors.  Qilin’s tactics include exploiting vulnerabilities in edge network devices, deploying credential theft tools, and developing sophisticated encryption mechanisms to hinder recovery. The group has previously targeted high-profile organizations including Nissan, Inotiv, Lee Enterprises, major hospitals within London’s NHS network, and automotive supplier Yangfeng. In its post, Qilin claimed that the Asahi ransomware attack could result in losses exceeding $335 million due to production halts affecting six breweries and more than thirty beer labels. Despite the claims, Asahi has not verified the authenticity of the leaked files. In a statement to BleepingComputer, a company spokesperson confirmed that the matter remains under active investigation and declined to comment further.  The company also shared that production of its flagship beer, Super Dry, has resumed through a temporary manual ordering system. While Asahi’s factories are not yet operating at full capacity, shipments for additional labels are expected to restart by October 15. However, as a direct consequence of the cyberattack and ongoing disruptions, Asahi announced it would delay the launch of new products that were initially planned for October 2025.  The attack on Asahi underscores the growing reach and sophistication of ransomware groups like Qilin, whose increasingly destructive campaigns continue to target global corporations across industries, threatening both economic stability and consumer trust.

Qilin Ransomware Gang Claims Cyberattack on Japanese Beer Giant Asahi #CyberAttacks #cybercriminalgroup #CyberSecurityRansomwareAttacks

FBI Warns of Silent Ransom Group Using Phishing and Vishing to Target U.S. Law Firms  The FBI has issued a warning about a sophisticated cybercriminal group known as the Silent Ransom Group (SRG), also referred to by aliases like Luna Moth, Chatty Spider, and UNC3753. This group has been actively targeting U.S.-based law firms and related organizations through advanced phishing techniques and social engineering scams. The group, which has been operational since 2022, is known for using deceptive communication methods to gain unauthorized access to corporate systems and extract sensitive legal data for ransom demands. In the past, SRG’s activities spanned across industries such as healthcare and insurance.  However, since the spring of 2023, its focus has shifted to legal entities, likely because of the highly confidential nature of the data managed by law firms. The group commonly uses a method called callback phishing, also known as reverse vishing. In this approach, victims receive emails that appear to originate from reputable companies and warn them of small charges for fake subscriptions. The emails prompt users to call a phone number to cancel the subscription. During these calls, victims are instructed to download remote access software under the guise of resolving the issue. Once the software is installed, SRG gains control of the victim’s device, searches for valuable data, and uses it to demand ransom.   In March 2025, SRG has adapted their strategy to include voice phishing or vishing. In this new approach, the attackers call employees directly, posing as internal IT staff. These fraudulent callers attempt to convince their targets to join remote access sessions, often under the pretext of performing necessary overnight maintenance. Once inside the system, the attackers move swiftly to locate and exfiltrate data using tools like WinSCP or a disguised version of Rclone. Notably, SRG does not prioritize escalating privileges, instead focusing on immediate data theft. The FBI noted that these voice phishing methods have already resulted in multiple successful breaches.  SRG reportedly continues to apply pressure during ransom negotiations by making follow-up calls to victim organizations. While the group does maintain a public site for releasing stolen data, its use of this platform is inconsistent, and it does not always follow through on threats to leak information. A significant concern surrounding these attacks is the difficulty in detection. SRG uses legitimate system management and remote access tools, which are often overlooked by traditional antivirus software. The FBI advises organizations to remain vigilant, particularly if there are unexplained downloads of programs such as AnyDesk, Zoho Assist, or Splashtop, or if staff receive unexpected calls from alleged IT personnel.  In response, the FBI urges companies to bolster cybersecurity training, establish clear protocols for authenticating internal IT requests, and enforce two-factor authentication across all employee accounts. Victims of SRG attacks are encouraged to share any information that might assist in ongoing investigations, including ransom communications, caller details, and cryptocurrency wallet data.

FBI Warns of Silent Ransom Group Using Phishing and Vishing to Target U.S. Law Firms #AdvancedSocialEngineering #CyberAttacks #cybercriminalgroup