106 Italian mafia members arrested for SIM swapping, BEC scams, phishing

A joint law enforcement operation between Europol, Italian, and Spanish police has resulted in the arrests of 106 members of the Italian mafia on crimes related to cybercrime and money laundering.

The suspects were arrested last week on the island of Tenerife, in Spain's Canary Islands, in a law enforcement operation named "Fontana Almabahia."

Members of the group were primarily focused on cybercrime-related activities, and authorities described them as having a "high degree of technicality."

The group executed SIM swapping attacks, phishing, and vishing in order to breach company networks and steal funds or trick employees into sending payments to the wrong accounts in a classic scheme called "CEO fraud" or "BEC scam."

Using these tactics, the group stole and later laundered more than €10 million (~$11.7 million) in stolen funds, using a network of money mules and shell companies, Europol said today.

Most of the victimized companies were based in Italy, but the group also defrauded and scammed companies from Ireland, Spain, Germany, Lithuania, and the UK.

Group led by fugitives of the Italian Neapolitan mafia

Spanish police said they began tracking the group in June 2020 when they detected dangerous individuals linked to Italian mafia organizations settling in the Canary Islands.

Members of this group were linked to four Italian mafia organizations, such as Camorra Napolitana, Nuvoletta, Casamonica, and Sacra Corona Unita.

Spanish police said they silently tracked the suspects as they operated and expanded over the past year in order to understand and learn their internal structure.

They said the group was organized in a typical gang-like pyramid structure, with the leaders at the top and the money mules at the bottom.

The leaders were members of the Italian Neapolitan mafia, who often traveled to the Canary Islands to supervise operations.

"For the mafia, this mode of financing was so important that they sent fugitive members of the Italian Justice from Italy to control their financing activities on location and supervise the obtaining and transfer of money," Spanish officials said.

The group infiltrated and terrorized Canary Island businesses

Just like any professional Italian mob operation, the group didn't just carry out their thefts. They also infiltrated several layers of the Canary Islands' society, such as business networks, law firms, and banks.

"This level of settlement not only gave the organization impunity for money laundering, but also for the different criminal activities of these mafia groups carried out in Spain," authorities said.

The group was also linked to prostitution rings, arms sales, drug trafficking, kidnapping, fraud, identity theft, document forgeries, Social Security scams, robberies, extortion beatings, and two murders, all taking place on the small Canary archipelago.

Authorities said the group needed hundreds of bank accounts to launder all their stolen funds, which they had to open and close at a fast pace in order to prevent their funds from being frozen.

At one point, desperate to gain access to new bank accounts, the group kidnapped and threatened a woman at gunpoint to open 50 bank accounts on behalf of the organization and then made her empty her own account in front of an ATM.

Once the attackers were identified and detained, the group threatened the victim and its friends to prevent them from testifying against them.

The group also extorted and robbed its own members who did not follow internal regulations.

Arrests made in Spain and Italy

Authorities dismantled the group last week following 16 raids in Santa Cruz de Tenerife, in Spain, and Turin and Isernia in Italy.

Authorities arrested 106, froze 118 bank accounts, seized 224 credit cards, 402 marijuana plants from a secret farm the group was operating, along with computer equipment, telephones, and SIM cards.

A ledger seized in the raids showed the group had obtained more than 80 SIM cards they were preparing to use in future SIM swapping attacks.

The arrests announced today are one of the clearest links between criminal cartels and the emerging cybercrime ecosystem. While such links have been suspected to exist, the arrests today confirm them without a doubt.

"As one of the people tracks all things BEC I can say with 100% accuracy that the Italian mafia was not on my radar. Like, not even a single quark on my radar," Ronnie Tokazowski, principal threat advisor at Cofense, told The Record today.

Golpe policial a la mafia italiana con la detención de 106 personas por blanquear más de 10.000.000€ procedentes de estafas informáticas

Operaban desde el sur de #Tenerife y blanqueaban dinero para clanes mafiosos italianos

Se han realizado 16 registros en #España e #Italia pic.twitter.com/N7WKFp5yXJ

— Policía Nacional (@policia) September 20, 2021