In Kyiv, members of a group that organized a bot farm to extort "crypto debts" from Ukrainians were detained. The defendants used online services Bitcapital and Crypsee to provide cryptocurrency loans, charging interest contrary to Ukrainian law. Debtors and their relatives were harassed with generated offensive content and a bot farm that numbered almost 6,000 subscriber numbers, UNN reports with reference to the National Police.
Details
Kyiv cyber police, together with investigators, detained seven members of a criminal group that provided online loans contrary to Ukrainian law and with non-transparent lending terms. If clients repaid loans on time, the defendants invented non-existent debts. Subsequently, the attackers extorted money from Ukrainians through blackmail and threats.
The suspects and their accomplices used the web resources Bitcapital and Crypsee, through which they accrued loans in Tether cryptocurrency. The illegality of this service's activities has been confirmed by a decision of the National Bank of Ukraine.
According to the investigation, the members of the organized group operated since 2023 under the guise of allegedly foreign companies registered in Great Britain and Cyprus, and organized a call center in the city of Dnipro. Operators called debtors and, using fabricated data and voice-changing programs, demanded repayment of funds.
At the same time, a separate link of 2-6 people could "work" on the victim, applying different approaches, adapting to the individual vulnerabilities of each victim. In case of success, each of them received a percentage of the credited amount.
At the same time, the defendants resorted to systematic cyberbullying using SMS bombers (software for automating mass messaging to specified phone numbers), as well as a bot farm that numbered almost 6,000 SIM cards of Ukrainian mobile operators and was even equipped with uninterruptible power supplies. Bots were involved in generating and disseminating humiliating content using data and photos of victims, their relatives and colleagues, as well as systematically making threatening phone calls.
Over time, the group formed its own "security service," which was supposed to ensure conspiracy measures, helped maintain the hierarchy within the structure, and also searched for and verified new perpetrators of the criminal scheme.
Cyber police operatives analyzed crypto wallets to which payments in the form of interest, fines, and penalties were received from victims. They also established the IP addresses from which calls were made and threats were sent to borrowers, their relatives, and acquaintances.
Police conducted 44 authorized searches in Dnipropetrovsk Oblast and in the city of Kyiv. More than 80 mobile phones, computer equipment, cash, draft records, copies of documents, seals, 13 SIM banks, and more than 5,000 SIM cards were seized.
It has been preliminarily established that as a result of the illegal activities of the attackers, victims, including servicemen of the Armed Forces of Ukraine, suffered damages totaling over 5 million hryvnias.
Currently, seven members of the organized group, including a co-organizer and perpetrators, have been notified of suspicion of extortion that caused property damage on a particularly large scale and committed under martial law, as well as coercion to perform or not perform civil law obligations, committed by an organized group that caused great damage (Part 3 of Article 355 and Part 4 of Article 189 of the Criminal Code of Ukraine). The suspects were remanded in custody with the possibility of bail. They face up to 12 years in prison with confiscation of property.
According to preliminary data, more than 1,500 people could have suffered from illegal activities.