Police bust cybercrime marketplace, phishing network

German police led a coalition of international law enforcement agencies to seize more than 50 servers and 200 terabytes data tied to a cybercrime marketplace and phishing network.

Europol said on Thursday that it supported the disruption of an unnamed cybercriminal network, which was led by Germany's Hanover Police Department and the Verden Public Prosecutor's Office. Additional assistance came from law enforcement agencies in Austria, the Czech Republic, Finland, the Netherlands and Poland. As part of the disruption effort, police seized more than 50 servers, gained digital evidence totaling more than 200 TB, and arrested two suspects, a 27-year-old and a 37-year old.

According to Europol's press release, law enforcement began investigating the network in fall 2022, "following reports of fraudulent phone calls in which scammers impersonated bank employees to extract sensitive information, such as addresses and security answers, from victims." Investigators then traced stolen data back to an online marketplace for illegally obtained data, as well as a phishing network.

"The marketplace allowed its thousands of users to buy stolen data sorted by region and account balance. This customisation enabled criminals to carry out targeted fraud with greater efficiency," Europol said in the press release. "Investigators also uncovered a network of fake online shops used to trick consumers into entering payment information, a method commonly referred to as phishing. The stolen credentials were then sold through the marketplace, generating significant profits for its operators."

Police carried out coordinated actions Wednesday. Searches were carried out in Germany and Austria, and the two suspects were similarly arrested in Germany and Austria and placed under pretrial detention. Infrastructure tied to the cybercrime marketplace and phishing network was seized in Germany, Finland, the Netherlands and Norway.

Though Europol did not identify the criminal network, Europol's announcement included a website takedown notice that referenced the "Manson Market." Additionally, as common with many cybercrime takedowns such as LockBit, the notice includes a taunting message to cybercriminals who may be reading it.

"All data has been obtained," the notice said. "All transactions, communications, and user information associated with the site are now in the custody of law enforcement. If you have engaged in any illegal activity, you are under investigation. Criminals are neither anonymous nor safe! Justice is coming…"

The Manson Market takedown follows another disruption Europol announced this week. On Tuesday, the international law enforcement agency revealed that French and Dutch authorities led a takedown of "Matrix," an encrypted messaging service "made by criminals for criminals."

TechTarget Editorial contacted Europol for additional information, but the agency has not responded at press time.

Alexander Culafi is a senior information security news writer and podcast host for TechTarget Editorial.