Ukrainian cyberpolice dismantled phishing group behind illegal property deregistrations

Ukrainian cyberpolice dismantled phishing group behind illegal property deregistrations

Cyber police officers in the Kyiv region, in collaboration with investigators from the National Police of Ukraine and under the procedural guidance of the Prosecutor General’s Office, have dismantled an organized criminal group that remotely accessed the devices of state enforcement officers and private notaries to illegally remove property restrictions for a fee.

According to law enforcement, four individuals, including a private enforcement officer, orchestrated a scheme to unlawfully lift encumbrances from citizens' movable and immovable property. Their goal was to facilitate illegal property transfers, and they openly advertised these illicit services in online communities.

The group used sophisticated phishing tactics, sending emails disguised as official communications from courts or government agencies. The emails contained malware that, once opened, silently installed itself on the recipient's device. The malware granted remote access and compromised the victim’s digital signature and password.

To avoid detection, the perpetrators carried out their operations in secluded areas, including forested zones in the Kyiv region. Equipped with specialized computer tools and anonymization software, they accessed systems remotely to deregister properties and conduct unauthorized re-registrations.

Authorities have now completed the pre-trial investigation. Charges have been filed against the group’s organizer and three accomplices. Depending on their roles, they face charges under several articles of Ukraine’s Criminal Code, including unauthorized interference with IT systems and the creation and distribution of malicious software.

If convicted, the accused face up to six years in prison.


Back to the list

Latest Posts

Cyber Security Week in Review: April 25, 2025

Cyber Security Week in Review: April 25, 2025

In brief: A SAP NetWeaver zero-day bug exploited in the wild, DslogdRAT exploits a recent Ivanti flaw, and more.
25 April 2025
ToyMaker: Financially-motivated IAB that sells access to ransomware gangs

ToyMaker: Financially-motivated IAB that sells access to ransomware gangs

ToyMaker is believed to be behind the custom backdoor dubbed ‘LAGTOY.’
24 April 2025
DragonForce and Anubis ransomware ops use novel models to attract affiliates and boost profits

DragonForce and Anubis ransomware ops use novel models to attract affiliates and boost profits

DragonForce introduced a distributed affiliate branding model.
23 April 2025