Europol operation “SIMCARTEL”: A devastating blow to cybercrime service providers

20 October 2025

1.In October 2025, the European Union Agency for Law Enforcement Cooperation (Europol) announced an unprecedented international operation codenamed “SIMCARTEL”, which dealt a major blow to organised cybercrime. The operation, which involved law enforcement authorities from several countries, including Estonia, dismantled a large-scale cybercrime-as-a-service (CaaS) platform. This network provided criminals worldwide with the tools and anonymity to commit large-scale fraud causing millions of euros in losses. This article provides a comprehensive overview of the background, execution, results and broader impact of Operation “SIMCARTEL” in the fight against cybercrime.

What are cybercrime-as-a-service (CaaS) and SIM farms?

To understand the significance of Operation “SIMCARTEL”, it is important to understand how modern cybercrime works. Cybercrime as a Service (CaaS) is a business model in which criminals offer their “colleagues” various illegal services and tools for a fee. It resembles the legitimate Software as a Service (SaaS) model, but its purpose is criminal. CaaS platforms enable even criminals with limited technical skills to carry out sophisticated attacks, ranging from phishing to ransomware attacks.

At the heart of Operation “SIMCARTEL” was precisely such a CaaS platform, which specialized in providing SIM cards and related technology. This involved the use of so-called SIM boxes and SIM farms. A SIM box is a device that can accommodate a large number of SIM cards. These devices are connected to the internet and use VoIP (Voice over IP) technology to route international calls and messages in a way that makes them appear to originate from a local network. A SIM farm is essentially a large number of SIM boxes located in one place and managed centrally.

Such technology allows criminals to:

•Conceal their identity and location: Calls and messages appear to come from local numbers, making it extremely difficult to trace their origin.

•Automating fraud: SIM farms can send thousands of fraudulent messages (smishing) or make fraudulent calls simultaneously.

•Create fake accounts on a massive scale: Social media platforms and other online services often require account verification using a phone number. SIM farms provide criminals with access to thousands of phone numbers, which are used to create fake accounts for further fraud, spamming, or spreading misinformation.

The “SIMCARTEL” network was technically highly sophisticated and provided its “clients” with a professional-level service, including websites (such as gogetsms.com and apisim.com) through which phone numbers from more than 80 countries could be ordered.

Anatomy of operation “SIMCARTEL”: International cooperation and its results

The operation culminated on 10 October 2025, when a large-scale raid was carried out in Latvia, resulting in the arrest of five Latvian cybercriminals. It was the result of a months-long, carefully planned international investigation coordinated by Europol and Eurojust and involving law enforcement agencies from Austria, Estonia, Finland and Latvia. One of the main suspects had previously been under investigation in Estonia for arson and extortion, demonstrating the broader scope of the criminals’ activities.

The results of the operation were impressive and demonstrate its scale:

Result	Quantity/Amount
Searches	26
People arrested	7
SIM boxes seized	~1,200
Active SIM cards	40,000
Additional SIM cards	Hundreds of thousands
Servers seized	5
Frozen bank accounts	431,000 EUR
Frozen cryptocurrency accounts	333,000 USD
Confiscated luxury cars	4

In addition to physical seizures and confiscations, the criminal network's digital infrastructure was also taken over. Through cooperation between Europol and Shadowserver Foundation, the network's websites were shut down and replaced with a law enforcement seizure notice. This not only stopped the provision of the service but also sent a clear signal to other cybercriminals.

Estonia's role in Operation “SIMCARTEL”

Estonia was an important partner in Operation “SIMCARTEL”. Eesti Politsei- ja Piirivalveamet and Põhja Ringkonnaprokuratuur actively participated in the investigation, demonstrating Estonia’s commitment to international cooperation in the fight against cybercrime. As mentioned, one of the main suspects was already on the radar of Estonian law enforcement agencies, highlighting how closely cybercrime is linked to other serious crimes.

Scale of the crimes: Millions of fake accounts and widespread fraud

The true scale of the “SIMCARTEL” network is only now becoming clear, but the initial data is shocking. This service was used to create over 49 million fake online accounts. These accounts and phone numbers were used to commit thousands of crimes, causing millions of euros in losses to victims. In Austria alone, more than 1700 küberpettuse juhtumi kogukahjuga 4,5 million euros have been linked to the network. In Latvia, 1500 cases are known, with losses of 420 000 euros.

The range of crimes enabled by this platform was extremely broad:

•Phishing and fraudulent text messages (smishing): This was one of the most common methods. Criminals sent victims messages that appeared to come from trusted sources (e.g. banks and postal companies) to trick them into clicking links infected with malware or disclosing their personal data, passwords and credit card information.

•“Daughter-son” scam: This is a scam based on emotional manipulation. Victims received a WhatsApp message supposedly from their child, who said they had a new phone number and asked them to transfer money to a new account for urgent reasons (e.g. an accident or emergency).

•Investment scams: Victims were contacted by phone and encouraged to “invest” large sums. Remote access software was often used to gain control of the victim's computer and steal data from it.

•Fake online stores and banking websites: Phone numbers rented from the network were used in the contact details of fake stores and banking websites to create the impression of legitimate activity.

•Fake police officers: A particularly cynical form of fraud in which criminals posed as police officers, used forged documents and persuaded victims to hand over their cash or bank card details.

In addition to financial fraud, the network was also linked to human smuggling and the distribution of child sexual abuse material, demonstrating the danger of CaaS platforms and their far-reaching impact on society.

Future outlook: The fight against cybercrime continues

Operation “SIMCARTEL” is undoubtedly a major victory for law enforcement agencies and a serious setback for cybercriminals. It demonstrates that international cooperation is the only way to successfully combat cross-border and technologically sophisticated crime. The roles of Europol and Eurojust as coordinators and the use of the EMPACT (European Multidisciplinary Platform Against Criminal Threats) framework are crucial here.

However, it is important to understand that the fight is not over. Cybercriminals are constantly developing new methods and technologies. The CaaS model makes cybercrime more accessible than ever before. Therefore, it is crucial to continue investing in both technological solutions and international cooperation. Raising public awareness is equally important. Each of us can contribute by being more cautious online and when communicating by phone, and by being more aware of common scams.

How can you protect yourself from cyber fraud?

•Be skeptical: If you receive an unexpected message or call asking you to act quickly, send money, or share personal information, always treat it with caution.

•Verify independently: If you receive a message allegedly from your bank or child, do not use any links or phone numbers in the message. Contact them through official channels that you have found yourself.

•Do not share personal information: Never share your passwords, PIN codes, or other sensitive information by phone or email.

•Use two-factor authentication: Wherever possible, enable two-factor authentication. This adds an extra layer of security to your accounts.

Operation “SIMCARTEL” is a reminder that real threats lurk in the digital world, but it also confirms that by working together, we can counter these threats and ensure a safer cyberspace for everyone.