On 10 October 2025, a significant law enforcement operation in Latvia led to the arrest of five Latvian cybercriminals and the seizure of critical infrastructure used to facilitate crimes against thousands of victims throughout Europe. The operation, codenamed ‘SIMCARTEL’, additionally resulted in the arrest of two more suspects, the takedown of five servers, and the confiscation of around 1,200 SIM box devices used alongside 40,000 active SIM cards.
Investigators from Austria, Estonia, and Latvia, supported by Europol and Eurojust, linked this criminal network to over 1,700 cyber fraud cases in Austria and 1,500 cases in Latvia, causing millions of euros in financial losses. Austria alone faced estimated damages of approximately EUR 4.5 million, with Latvia suffering around EUR 420,000 in losses.
The criminal infrastructure was highly sophisticated and allowed offenders worldwide to use the SIM-box service for a range of telecommunication-related cybercrimes and other illegal activities. The network provided telephone numbers from over 80 countries, enabling criminals to create fake accounts on social media and communication platforms to mask their identities.
Key Results from the Operation:
- 26 premises searched
- 5 individuals arrested in Latvia
- 1,200 SIM box devices seized, operating 40,000 SIM cards
- Hundreds of thousands of additional SIM cards confiscated
- 5 servers and associated illegal service infrastructure taken down
- 2 illegal websites (gogetsms.com and apisim.com) seized and replaced with law enforcement splash pages
- EUR 431,000 frozen in suspects’ bank accounts
- USD 333,000 frozen in crypto accounts
- 4 luxury vehicles confiscated
The true scope of this criminal network is still emerging. Over 49 million online accounts were created using this illicit service, cumulatively causing several million euros in damage to victims.
Crimes Enabled by the Network
This SIM box service allowed criminals to hide their true identities while committing numerous crimes, including phishing and smishing—methods used to steal sensitive personal and financial information via fake emails, texts, or calls. The network also facilitated fraud, extortion, migrant smuggling, and the distribution of child sexual abuse material.
Examples of criminal activities facilitated include:
- Fraud on Online Marketplaces: Criminals created fake accounts using rented SIMs to scam buyers and sellers.
- Daughter-Son Scams: Offenders posed as a victim’s child in distress via WhatsApp, demanding urgent payments.
- Investment Fraud: Victims were coaxed into investing large sums over the phone, with perpetrators often controlling devices remotely.
- Fake Shops and Bank Websites: Rented numbers were used for fake contact information in scams involving fraudulent shops and banks.
- Fake Police Officer Scams: Mainly targeting Russian-speaking victims, perpetrators impersonated police to extort money personally.
Operational Sophistication
The criminal group operated a professional website and coordinated a global effort, acquiring thousands of SIM cards from almost 80 countries. One key suspect had previous criminal investigations related to arson and extortion in Estonia.
Collaborative International Effort
Eurojust and Europol played vital roles in coordinating the action day, supporting planning, technical capabilities, and forensic evidence collection. Specialists were deployed to Riga to assist local authorities. The technical infrastructure was dismantled with help from the Shadowserver Foundation, and a warning splash page replaced the criminal service’s website.
Participating Countries and Agencies
- Austria: Federal Criminal Intelligence Service, Criminal Investigation Department Salzburg, Vienna Public Prosecutor’s Office
- Estonia: Estonian Police, Northern District Prosecutor’s Office
- Finland: Finnish Police, National Cyber-enabled Crimes Unit, National Bureau of Investigation
- Latvia: Latvian State Police, Rīga Judicial Region Prosecution Office, Rīga Northern Prosecution Office
This operation illustrates the complexity and international nature of combating cybercrime-as-a-service, highlighting the importance of cross-border cooperation to protect victims and dismantle criminal networks.
If you would like, the video footage of the operation published by the Latvian police is accessible below for further context.
