Polish police dismantle cybercrime gang accused of impersonation scams, arrest nine suspects

Avatar

Polish police dismantled an international cybercrime group accused of defrauding dozens of victims out of nearly $665,000, authorities said Tuesday.

Nine people were detained in connection with the case. Investigators said the suspects, who ranged in age from 19 to 51 years old, posed as bank employees and law enforcement officers to trick victims into transferring funds to fraudulent accounts. In total, at least 55 people were targeted.

According to police, the group used spoofing software to impersonate phone numbers belonging to banks, prosecutors’ offices and police departments. The stolen funds were later converted into cryptocurrencies.

The alleged scheme began in April 2023, and the police said the group operated across several countries. Most of the suspects are Ukrainian nationals, while others come from Georgia, Moldova and Azerbaijan. Polish authorities previously charged 46 other individuals in connection with the operation.

A court has ordered pre-trial detention for some of the suspects, and three Ukrainian nationals have been banned from entering Poland and some other European countries. The detainees face charges including participation in an organized criminal group, money laundering, and illegally accessing online banking data — offenses that carry penalties of up to 15 years in prison.

Authorities said the investigation is ongoing and may lead to further arrests.

In a separate case, Dutch authorities sentenced a 24-year-old man to 18 months in prison earlier this week for planning phishing attacks and installing hacking tools on his computers.

In France, a Belarusian national was sentenced to five years in prison on Monday for conducting ransomware attacks on French companies. He was arrested in Georgia in 2022 and extradited to France last year.

NewsCybercrime
Get more insights with the

Recorded Future

Intelligence Cloud.

Learn more.

No previous article

No new articles

Daryna Antoniuk

is a reporter for Recorded Future News based in Ukraine. She writes about cybersecurity startups, cyberattacks in Eastern Europe and the state of the cyberwar between Ukraine and Russia. She previously was a tech reporter for Forbes Ukraine. Her work has also been published at Sifted, The Kyiv Independent and The Kyiv Post.

 

Total
0
Shares
Previous Post

The FBI’s Brett Leatherman gives the latest ‘Typhoon’ forecast

Next Post

DarkWatchman cybercrime malware returns on Russian networks

Related Posts

⚡ Weekly Recap: Critical SAP Exploit, AI-Powered Phishing, Major Breaches, New CVEs & More

What happens when cybercriminals no longer need deep skills to breach your defenses? Today’s attackers are armed with powerful tools that do the heavy lifting — from AI-powered phishing kits to large botnets ready to strike. And they’re not just after big corporations. Anyone can be a target when fake identities, hijacked infrastructure, and insider tricks are used to slip past security
Avatar
Read More

Hackers Exploit Apache HTTP Server Flaw to Deploy Linuxsys Cryptocurrency Miner

Cybersecurity researchers have discovered a new campaign that exploits a known security flaw impacting Apache HTTP Server to deliver a cryptocurrency miner called Linuxsys. The vulnerability in question is CVE-2021-41773 (CVSS score: 7.5), a high-severity path traversal vulnerability in Apache HTTP Server version 2.4.49 that could result in remote code execution. "The attacker leverages
Avatar
Read More

New PHP-Based Interlock RAT Variant Uses FileFix Delivery Mechanism to Target Multiple Industries

Threat actors behind the Interlock ransomware group have unleashed a new PHP variant of its bespoke remote access trojan (RAT) as part of a widespread campaign using a variant of ClickFix called FileFix. "Since May 2025, activity related to the Interlock RAT has been observed in connection with the LandUpdate808 (aka KongTuke) web-inject threat clusters," The DFIR Report said in a technical
Avatar
Read More