Skip Ribbon Commands
Skip to main content
Navigate Up
Sign In

Press releases

Major cybercrime group dismantled by joint investigation team


Disclaimer: The press releases above have been translated from the original English version. Eurojust cannot be held responsible for the quality of the translation. In the event of any discrepancies, please consult the original English version of the press release.

The Hague, 25 June 2015

A joint investigation team (JIT), consisting of investigators and judicial authorities from six different European countries, supported by Eurojust and Europol, has taken down a major cybercriminal group during coordinated actions in Ukraine.

With the support of Eurojust and on-the-spot support from Europol, Austrian and Belgian judicial and law enforcement authorities, the actions in Ukraine on 18 and 19 June resulted in the arrest of five suspects, eight house searches in four different cities, and the seizure of computer equipment and other devices for forensic examination.

The objective of this JIT was to target high-level cybercriminals and their accomplices, who are suspected of developing, exploiting and distributing Zeus and SpyEye malware - two well-known banking Trojans - as well as channelling and cashing-out the proceeds of their crimes. The cybercriminals used malware to attack online banking systems in Europe and beyond, adapting their sophisticated banking Trojans over time to defeat the security measures implemented by the banks. Each cybercriminal had a speciality and the group was involved in infecting tens of thousands of computers, harvesting bank credentials, and laundering the money through so-called ‘money mule’ networks.

This very active group of cybercriminals actively traded stolen credentials, compromised bank account information and malware on digital underground forums, while selling their hacking ‘services’ and looking for new cooperation partners for other cybercriminal activities. The damage caused by the group is estimated to be at least EUR 2 million.

This case demonstrates that combating cybercrime in a successful and sustainable way is only possible if all actors - that means investigative judges and judicial authorities - coordinate and cooperate across borders,’ said Mrs Ingrid Maschl-Clausen, Eurojust National Member for Austria, at a press conference in Vienna.

In one of the most significant operations coordinated by the agency in recent years, Europol worked with an international team of investigators to bring down a very destructive cybercriminal group. With our international partners, we are committed to fighting the threats brought about by malware and other forms of cybercrime, to realise safer technology infrastructures and online financial transactions for businesses and people the world over,’ said Rob Wainwright, Director of Europol.

The recent action was part of a wider investigation that was launched in 2013 by the JIT members (Austria, Belgium, Finland, the Netherlands, Norway and the UK) and facilitated by Europol and Eurojust. Last week’s results bring the total number of arrests in this operation to 60 – 34 of whom were captured as part of a money mule operation run by Dutch law enforcement authorities.

Eurojust hosted eight coordination meetings, bringing together the judicial authorities and investigating judges of all the involved States. Moreover, Eurojust provided legal advice and assisted with the drafting of the JIT agreement, and supported the JIT during the entire process. Eurojust also enabled contact at judicial level between third States, particularly with Ukraine.

Europol provided crucial support to the investigation since 2013, including the handling and analysis of terabytes of data and thousands of files in the Europol Malware Analysis System; handling of thousands of sensitive operational messages; producing intelligence analysis reports; forensic examination of devices; and organising operational meetings and bi-monthly international conference calls. The data will now be used to trace those cybercriminals still at large. Both Eurojust and Europol provided funding for the JIT.

Several action days took place during the course of the long-running investigation, which resulted in significant operational successes in Belgium, Estonia, Finland, Latvia, the Netherlands and Ukraine. Such results were possible thanks to intensive cooperation between the JIT, judicial partners and law enforcement in Estonia, Latvia, Germany, Moldova, Poland Ukraine and the USA.

Press release from the Austrian authorities: DE  EN

Chronology: DE  EN

For interviews and further information, please contact:

Ulf Bergström
Head of Communications and External Relations
Press & PR Service
Tel: +31 70 412 5508

Lisanne Kosters, Europol Corporate Communications, +31 70 302 50 01

For all Eurojust press releases, please see (Press centre)