In October 2025, law enforcement agencies from Latvia, Austria, Estonia, and Finland — coordinated by Europol and Eurojust — executed Operation SIMCARTEL, dismantling a sophisticated cybercrime-as-a-service network linked to over 3,200 fraud cases and nearly €4.9 million in confirmed losses.

Reason: Profitability Through Simple, Accessible Crime

The operation showed how cybercrime has evolved into a scalable business model. For an investment of just a few hundred thousand euros, criminals built an infrastructure including 1,200 SIM box devices, 40,000 active SIM cards, five servers, and two central websites for renting phone numbers from over 80 countries. This infrastructure supported the creation of 49 million fake online accounts used in phishing, impersonation, investment scams, extortion, and identity fraud.

Tools: Industrialized Crime Made Easy

At the core were SIM boxes — telecom devices repurposed to automate sending and receiving SMS messages across thousands of mobile numbers. Through the websites, customers with little to no technical knowledge could rent foreign phone numbers cheaply, gaining the ability to bypass SMS verification and create fake accounts on platforms worldwide. This “crime-as-a-service” model industrialized cybercrime logistics, lowering the bar for entry and expanding risks globally.

Accessible Crime for Sale: A Warning to Businesses

This operation proves the myth that “I’m not a target because I’m small or cheap” is dangerously false. Cybercrime-as-a-service platforms make it affordable and easy for anyone to obtain cybercrime capabilities. Criminals focus on low-hanging fruits — businesses without dedicated cybersecurity measures are the easiest and most lucrative targets.

Business Imperatives from SIMCARTEL

• You cannot ignore cybersecurity just because your company is small or perceived as unimportant.
• The availability of ready-made criminal infrastructure means cyber attacks can be bought and deployed by anyone.
• There is no perfect security; even large companies are victims. But every organization must take steps to protect itself.
• Invest in defense layers, incident response, and consult with verified cybersecurity specialists to reduce risk.

Operation SIMCARTEL is a stark example of how affordable, accessible criminal tools have transformed cybercrime into a business, targeting wherever defenses are weakest. For every business, cybersecurity is now a critical investment, not an optional cost.

Author: Alexey Shulenkov (Head of CyberSec Division, DAAC digital)