Three Belarusian nationals charged for forcing Polish plane to land to arrest dissident

Source: Eurojust

Belarusian air traffic controllers forced the aircraft to divert from its route to Vilnius by providing false information about an alleged explosive device, forcing the pilots to make an emergency landing at Minsk airport. After the aircraft landed in Minsk, the passengers were evacuated and their luggage was searched.

During the evacuation, two passengers, a Belarusian dissident and his companion, were arrested by officials. Investigations into the incident revealed that these arrests were the real reason the flight was diverted to Minsk.

Immediately after the incident, investigations were launched by the Polish and Lithuanian authorities. With the support of Eurojust, a joint investigation team (JIT) team was set up, which interviewed a number of witnesses, including passengers and the crew of the aircraft, and secured recordings and photographs taken during the incident.

The unprecedented nature of the case called for very close cooperation between multiple countries. Eurojust organised several coordination meetings and facilitated the execution of European Investigation Orders in Bulgaria, Greece and Romania to secure evidence and the requests for legal assistance in Switzerland, Norway and the United States.

Witnesses testified that air traffic controllers were informed of the false bomb threat by their superiors. The air traffic controllers were then instructed by Belarusian officials on what action to take and what information to pass on to the pilots of the aircraft.

The cooperation of the authorities led to the issuing of arrest warrants for three Belarusian nationals. The suspects are charged with unlawfully depriving 132 people of their liberty through terrorist acts and intending to seriously intimidate numerous people, including groups opposed to the Belarusian regime. Detention on remand for three months is imposed on all suspects.

The following authorities were involved in the actions:

  • Lithuania: Department for Organised Crime and Corruption Investigation at the Prosecutor General’s Office, Criminal Police Bureau
  • Poland: Mazovian Division of the Department for Organised Crime and Corruption of the National Public Prosecutor’s Office; Internal Security Agency

Eurojust supports authorities in dismantling EUR 113 million fraudulent investment scheme

Source: Eurojust

A fraudulent pyramid scheme was taken down by authorities from Germany, Switzerland, Austria, Czechia, Lithuania and Liechtenstein, with the support of Eurojust and Europol. The organised crime group (OCG) used an investment model that focused on the leasing and subleasing of cryptocurrency machines, such as exchange machines and hardware for mining. The suspects were able to target thousands of victims, causing losses of up to EUR 113 million. During an action day on 11 June, six arrests were made, 29 searches were conducted and the suspects’ assets were frozen.

The advertised investment concept involved the leasing of cryptocurrency products, such as investments in server storage for internet cloud services and the subleasing of crypto exchange machines. The suspects promised returns of 70% before tax to those joining the scheme. Investigations by German authorities showed that the promised returns were not only unrealistic, but also impossible, as the leased equipment and systems allegedly did not exist.

As the promised investment scheme did not exist as advertised, the suspects created a pyramid scheme, where most of the revenue for earlier investors came from more recent investors. The funds collected were not used for the promised investments, but mainly for the suspects’ living expenses. Throughout the scheme, the suspects concluded thousands of contracts, earning up to EUR 113 million.

As soon as the fraudulent scheme was discovered by German authorities, two coordination meetings were held at Eurojust to exchange information and evidence with authorities from Germany, Switzerland, Austria, Czechia, Lithuania and Liechtenstein. To ensure a continued smooth cooperation, a joint investigation team (JIT) between German and Swiss authorities was set up with the support of Eurojust.

The cooperation between authorities resulted in an action day on 11 June, with the involvement of over 280 officers on the ground. The actions resulted in six arrests, 29 searches, the seizing of evidence, and the freezing of several assets. Due to the coordination between the authorities, and the use of Eurojust’s facilities, simultaneous actions were carried out in Germany, Switzerland, Austria, Czechia, Lithuania and Liechtenstein.

The following authorities were involved in the operation:

  • Germany: Public Prosecutor`s Office Erfurt, Criminal State Investigation Office Thuringia
  • Switzerland: Public Prosecutor’s Office of the Canton of Zurich
  • Austria: Central Public Prosecutor`s Office for Combating Economic Crimes and Corruption
  • Czechia: Municipal Public Prosecutor´s Office in Prague; Regional Directorate of Police of the Capital City of Prague
  • Lithuania: Vilnius Regional Prosecutor’s Office
  • Liechtenstein: Princely Court of Justice of Liechtenstein

Eurojust assists in uncovering a high-level corruption scheme

Source: Eurojust

It is believed that with their bribes, the fugitives with a Red Notice attempted to obtain asylum or refugee seeker status in Moldova or other countries in an effort to delete or block a Red Notice. Moreover, the suspects sought information about their INTERPOL Red Notice to try and avoid detection. A Red Notice is a request to law enforcement agencies worldwide to locate an individual for extradition, surrender or other legal action.

Effective and quick international cooperation was key to putting a stop to the corruption scheme. INTERPOL, the International Criminal Police Organization based in France, alerted the French authorities about the possible corruption scheme and the bribes taking place in Moldova. Eurojust’s support was instrumental in ensuring that French and Moldovan authorities were able to work together rapidly.

A joint investigation team was set up at Eurojust between French and Moldovan authorities during a coordination meeting at the Agency. This enabled the authorities to exchange information and evidence, determine the judicial strategy and carry out joint operations. Authorities from the United Kingdom supported the operation by providing important information on the suspects after linking the operation to a separate investigation into an international cybercrime network.

On 4 June, an action day took place in Moldova, during wich search warrants were executed for 12 persons in 33 locations. Mobile phones, laptops, computers and other items and documents were seized during the operation, which received grants from Eurojust’s funding programme for joint investigation teams. Four people were detained for up to 72 hours. On 5 June, a high-level official was arrested for 30 days at the request of the Moldovan prosecutor.

The operation was carried out by the following authorities:

  • France: National Financial Prosecutor’s Office; OCLCIFF (Central Anti-Corruption Office within the French National Police)
  • Moldova: Anti-corruption Prosecution Office
  • United Kingdom: National Crime Agency

Successful operation against cryptocurrency scam coordinated by Eurojust

Source: Eurojust

A coordinated operation to uncover an intricate cryptocurrency scam led to the arrest of a suspect in France. The investigation in Portugal, France, Germany, Italy and Romania, supported by Eurojust and Europol, revealed that the suspects were using a scam method known as ‘rip deals’ that caused losses of EUR 700 000 to Portuguese victims.

Scammers using the ’rip deal’ method trick their victims into exchanging money via a fraudulent money exchange programme, which they then use to steal the victim’s assets.

Investigations revealed that the suspects scammed victims across Europe, including in Austria, Italy, Portugal, Spain and Switzerland. The suspects would approach their victims by expressing an interest in acquiring commercial businesses. After gaining their trust and convincing them to install crypto asset wallets, the suspects would steal the victim’s funds.

In the next phase of the scam, other members of the organised crime group would launder the proceeds of the fraud by moving them through several crypto assets. This made it difficult to trace the proceeds.

The investigation, spanning several years, culminated in an action day supported by Eurojust and Europol. During the operation, carried out simultaneously in France, Germany, Italy, and Romania, one suspect was arrested and several houses were searched. Authorities froze multiple bank accounts and seized material goods such as equipment containing information on the scam.

Eurojust supported the investigation by enabling cooperation between the countries involved in the operation. The coordination meeting at Eurojust helped the authorities to exchange information and prepare for the action day. Additionally, Eurojust supported the execution of European Investigation Orders (EIOs), European Arrest Warrants (EAWs), and freezing orders.

The following authorities were involved in the coordinated operation:

  • Portugal: Regional Department for Criminal Investigation and Prosecution of Coimbra; Judicial Police
  • France: Judiciary Tribunal of Bobigny; National Police 93
  • Germany: Public Prosecutor’s Office Darmstadt; ZK32 at Criminal Directorate Offenbach, Southeast Hesse Police
  • Italy: Public Prosecutor Office in Milan; Italian State Police – Cyber Security Operations Centre “Lombardia” in Milan
  • Romania: Directorate for Investigating Organized Crime and Terrorism – Territorial Structure Timișoara; Romanian Police, Office of Combating Organised Crime Timisoara – Unit Combating Informatics Crimes.

Network of luxury car thieves dismantled with support of Eurojust

Source: Eurojust

A large-scale ring of luxury car thieves has been dismantled with the support of Eurojust and Europol. Using straw men and underprivileged people, the criminals hired or leased luxury vehicles, which they later registered in their own names through corrupt connections in official institutions.

The cars were resold outside the EU, including in the United Kingdom and the United Arab Emirates. In a series of recent coordinated actions in Spain, France, Germany, Latvia, Poland and Ukraine, 13 suspects were arrested for fraud, forgery and money laundering.

© – Ukrainian National Police

Through a coordination centre at Eurojust, over sixty places were also searched by national authorities. Several luxury vehicles, communication equipment and documents were seized, as well as over EUR 100 000 in cash.

The Spanish authorities launched their investigation in 2022 following reports of luxury cars going missing from legitimately operating car rental and lease companies in and around Malaga. These investigations revealed that dozens of vehicles were ultimately stolen across Europe by a network of linked criminals. They exploited around fifty vulnerable and underprivileged people by using their documents, such as driving licences and passports, to hire or lease luxury cars.

Through corrupt contacts in official institutions, they managed to register the hired vehicles on to their personal documents, so they could sell them in the European Union and beyond, including Ukraine, the United Kingdom and the United Arab Emirates. Some of the stolen vehicles were transported in containers to conceal the cars.

Investigations were later also started in France, Poland and Ukraine, which revealed links between different criminal groups using the same modus operandi. In March of this year, with the support and funding of Eurojust, authorities in France, Spain and Ukraine set up a joint investigation team into the car thefts. Eurojust also organised two preparatory coordination meetings to prepare for the recent action day week and set up the coordination centre.

Europol assisted the operations against the criminal network by producing criminal intelligence packages. It also provided an operational coordination centre to support the actions at police level.

Operations on the ground were carried out at the request of and by the following authorities:

  • Spain: Investigative Court no. 1, Málaga; Public Prosecutor’s Office, Málaga; Spanish National Police
  • France: Judiciary Tribunal, Grasse; National Gendarmerie, Central Office against Roving Crime (OCDLI)
  • Germany: Public Prosecutor’s Offices Essen and Osnabrück; Police Departments of Essen and Osnabrück
  • Latvia: 3rd Unit International Cooperation Department State Police
  • Poland: Public Prosecutor’s Office, Warsaw
  • Ukraine: Prosecutor General’s Office; Main Investigation Department and Department of Strategic Investigations of National Police

Major operation to take down dangerous malware systems

Source: Eurojust

In an unprecedented operation against aggressive and dangerous computer malware, authorities in the European Union and beyond have taken actions against droppers including IcedID, Pikabot, Smokeloader, Bumblebee and Trickbot, which infiltrated computers via emails. The measures focused on disrupting criminal services through arresting suspects, the freezing of illegal proceeds, and taking down botnets, coordinated by Eurojust. The operation, which was carried out this week with support of Europol, is a follow up to the successful takedown of the Emotet malware system in 2021.

During actions carried out simultaneously in Germany, the Netherlands, France, Denmark, Ukraine, the United States and United Kingdom, 4 suspects were arrested, who offered the malware as a professional blackmail service to other criminal actors. Some of the suspects were involved in operating Emotet in the past.

Via so called ‘sinkholing’ techniques or the use of tools to access the systems of operators behind the malware, investigators managed to block and take down the botnets. Malware droppers are types of malicious software which downloads viruses, ransomware or spyware on computers. They are generally installed via mails with infected links or Word and PDF attachments, such as shipping invoices or order forms, to get access to personal data and or bank accounts of computer users.

Mainly enterprises and national authorities and institutions were made victims of the series of malware systems which now have been taken down. Users are warned to be careful when opening links and attachments to mails and check the origin of mails.

The investigations, which have been ongoing since the takedown of Emotet, also focused on the running of that malware itself as their operators did create the new botnets mentioned. During the coordinated actions 16 places were searched.

In total over 100 servers were taken down or disrupted and over 2 000 domains are under control of law enforcement authorities.

Furthermore, investigations showed that one of the main suspects has earned at least EUR 69 million in cryptocurrency by renting out criminal infrastructure for the deployment of ransomware. The transactions are constantly being monitored and legal permission to seize these assets instantly through future actions has already been obtained.

Eurojust set up a coordination centre on its premises to manage simultaneous actions in all countries concerned. The Agency also assisted national authorities in the preparation and execution of European Arrest Warrants, European Investigation Orders and requests for Mutual Legal Assistance, and organized five coordination meetings.

The following national authorities were involved in the operations on the ground:

  • Germany: Prosecutor General’s Office Frankfurt am Main – Cyber Crime Center; Federal Criminal Police Office (Bundeskriminalamt)
  • The Netherlands: National Prosecution Service; National Police
  • Austria: Public Prosecutor’s Office of Salzburg; Criminal Intelligence Service Austria (Bundeskriminalamt)
  • Denmark: National Special Crime Unit (NSK)
  • France: Prosecutor’s Office JUNALCO (National Jurisdiction against Organised Crime) Cybercrime Unit; Gendarmerie Nationale C3N
  • Ukraine: Prosecutor General’s Office; Main Investigation Department of National Police of Ukraine; Cyber Department of the Security Service of Ukraine
  • United Kingdom: National Crime Agency
  • United States: United States Department of Justice, Federal Bureau of Investigation, The Defense Criminal Investigative Service

Crackdown on criminal network that used minors and women for street begging in Portugal

Source: Eurojust

Supported by Eurojust and Europol, judicial and law enforcement authorities in Portugal and Romania have dismantled an organised crime group involved in human trafficking, qualified fraud and money laundering. The suspects allegedly transported Romanian citizens, mostly minors and women, to Portugal and used them to beg for a fictitious association, posing as deaf-mute children and young people.

The criminal network is believed to have made a profit of over EUR 230,000 from this criminal activity.

During a joint action on 11-14 March, the Portuguese and Romanian authorities carried out six house searches, interrogated three defendants and interviewed five witnesses in Romania. Eight more suspects were interrogated in the weeks following the operation. At least thirty victims were identified and brought to safety.

Eurojust assisted the Portuguese and Romanian authorities in setting up and funding a joint investigation team into the case in April 2023. The Agency organised and hosted two coordination meetings to facilitate judicial cooperation and prepare for the joint action.

Europol facilitated the exchange of information between the different law enforcement authorities involved.

The following authorities took part in this investigation:

  • Portugal: Porto Public Prosecution Office; Porto Public Security Police
  • Romania: Directorate for Investigating Organised Crime and Terrorism – Central Structure (PPO); Service for Combating Organised Crime Ialomita (police)

Crackdown on criminal network dealing with online investment fraud

Source: Eurojust

Judicial and law enforcement authorities in Germany, Cyprus, Bulgaria and Sweden have carried out a coordinated action against an organised crime group suspected of online trading fraud. The network defrauded numerous victims for several millions of euros in Germany and other European countries.

During a joint action day supported by Eurojust and Europol, four suspects were arrested and thirteen places were searched.

The suspects allegedly belong to a hierarchical criminal network with numerous members. The suspects ran several fraudulent online trading platforms from call centres and other locations in Cyprus. The perpetrators presented themselves as investment advisors and convinced victims to invest large amounts of money based on fake promises of profits.

The damage caused to German victims by the two main platforms is estimated at EUR 3.3 million and EUR 164 000, respectively. The total damage caused by the platforms is likely to be many times higher. Eurojust assisted the investigations by organising a coordination meeting and setting up a coordination centre to facilitate rapid cooperation between the judicial authorities during the joint action day. The Agency also assisted with the transmission and execution of six European Arrest Warrants and several European Investigation Orders.

Europol supported this case by hosting and financing several operational meetings as well as the action day. Furthermore, it provided analytical support and financial intelligence during the investigation. On the action day, a Europol specialist with a mobile office and a universal forensic extraction device (UFED) were deployed to Cyprus, while colleagues back in The Hague offered technical support for the virtual command post.

The following authorities took part in this investigation:

  • Germany: Public Prosecutor’s Office of Göttingen; Centre for Cybercrime, Police Göttingen
  • Bulgaria: Sofia City Public Prosecutor’s Office; General Directorate Bulgarian National Police
  • Cyprus: International Police Cooperation Sub-Directorate – Police Cooperation Bureau Cyprus Police
  • Sweden: Swedish Police Authority