German court convicts alleged mastermind behind global investment scam network

A German court has sentenced a suspected central figure in the so-called Milton Group call-center fraud network to seven-and-a-half years in prison.

The Bamberg Regional Court in Bavaria handed down the sentence last Thursday after an 11-day trial conducted under heightened security measures, according to reports by local media and the Organized Crime and Corruption Reporting Project (OCCRP).

Although the court did not publicly name the defendant, court records reviewed by OCCRP indicate the person convicted was Mikheil Biniashvili, a citizen of Georgia and Israel.

Judges found that between 2017 and 2019, the defendant ran a call-center operation in Albania that used trained agents to persuade victims to invest in fraudulent online trading schemes. The scheme caused losses of about €8 million ($9.4 million) to victims, mostly in German-speaking countries.

The operation employed up to 600 people at its peak. Call-center agents allegedly posed as investment advisers, building trust with targets before persuading them to deposit funds into fake trading platforms controlled by the network.

According to the court, victims were promised large investment returns, but their money was never invested. Instead, judges said, the funds were “pocketed” by operators running the scheme.

Prosecutors said Biniashvili played a broader role than managing call centers. According to the verdict, he created and sold proprietary software known as PumaTS — a customer-management and trading platform that allowed fraudulent operations to scale globally.

After leaving day-to-day operations in 2019, he continued selling the software to other criminal groups, enabling copy-and-paste versions of the scam model in multiple countries. The court attributed an additional €42 million ($49 million) in damages to fraud operations using the software.

Alongside the prison sentence, the court ordered the confiscation of €2.4 million ($2.8 million) linked to the operation. The defendant confessed as part of a plea agreement and apologized to victims, according to the court statement. The verdict is not yet final and can still be appealed.

Biniashvili was arrested in Armenia in 2023 and extradited to Germany in 2024, where he has remained in pretrial detention, according to the report by Fränkischer Tag.

OCCRP previously reported that the network of call centers operated across several countries, including Georgia, Albania, and Ukraine, using large teams of sales agents to pitch fake investment opportunities worldwide. While the call centers used different brand names with customers, they were known internally as Milton Group in Ukraine and Morgan Limited in Georgia.

Get more insights with the

Recorded Future

Intelligence Cloud.

Learn more.

No previous article

No new articles

Daryna Antoniuk

Daryna Antoniuk

is a reporter for Recorded Future News based in Ukraine. She writes about cybersecurity startups, cyberattacks in Eastern Europe and the state of the cyberwar between Ukraine and Russia. She previously was a tech reporter for Forbes Ukraine. Her work has also been published at Sifted, The Kyiv Independent and The Kyiv Post.

 

Total
0
Shares
Previous Post

⚡ Weekly Recap: SD-WAN 0-Day, Critical CVEs, Telegram Probe, Smart TV Proxy SDK and More

Next Post

Google Develops Merkle Tree Certificates to Enable Quantum-Resistant HTTPS in Chrome

Related Posts

Wormable XMRig Campaign Uses BYOVD Exploit and Time-Based Logic Bomb

Cybersecurity researchers have disclosed details of a new cryptojacking campaign that uses pirated software bundles as lures to deploy a bespoke XMRig miner program on compromised hosts. "Analysis of the recovered dropper, persistence triggers, and mining payload reveals a sophisticated, multi-stage infection prioritizing maximum cryptocurrency mining hashrate, often destabilizing the victim
Read More

Cisco Fixes Actively Exploited Zero-Day CVE-2026-20045 in Unified CM and Webex

Cisco has released fresh patches to address what it described as a "critical" security vulnerability impacting multiple Unified Communications (CM) products and Webex Calling Dedicated Instance that it has been actively exploited as a zero-day in the wild. The vulnerability, CVE-2026-20045 (CVSS score: 8.2), could permit an unauthenticated remote attacker to execute arbitrary commands on the
Read More

BeyondTrust Flaw Used for Web Shells, Backdoors, and Data Exfiltration

Threat actors have been observed exploiting a recently disclosed critical security flaw impacting BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA) products to conduct a wide range of malicious actions, including deploying VShell and  The vulnerability, tracked as CVE-2026-1731 (CVSS score: 9.9), allows attackers to execute operating system commands in the context of the
Read More