20 arrests in QQAAZZ multi-million money laundering case

20 individuals suspected of belonging to the QQAAZZ criminal network which attempted to launder tens of millions of euros on behalf of the world’s foremost cybercriminals have been arrested.

The unprecedented international law enforcement operation involved 16 countries and some 40 house searches were carried out in Latvia, Bulgaria, the UK, Spain and Italy, with criminal proceedings initiated against those arrested by the US, Portugal, the UK, and Spain.

Criminal indictments returned by federal grand juries in Pittsburgh, US, set forth allegations of how this criminal network operated. It is estimated that the QQAAZZ network laundered, or attempted to launder, tens of millions of euros in stolen funds since 2016.

The QQAAZZ network opened and maintained hundreds of corporate and personal bank accounts at financial institutions throughout the world to receive money from cybercriminals who stole it from accounts of victims.

The funds were then transferred to other QQAAZZ-controlled bank accounts and sometimes converted to cryptocurrency using ‘tumbling’ services designed to hide the original source of the funds. After taking a fee of up to 50%, QQAAZZ returned the balance of the stolen funds to their cybercriminal clientele. 

The QQAAZZ members secured these bank accounts by using both legitimate and fraudulent Polish and Bulgarian identification documents to create and register dozens of shell companies which conducted no legitimate business activity.

Using these registration documents, the QQAAZZ members then opened corporate bank accounts in the names of the shell companies at numerous financial institutions within each country, thereby generating hundreds of QQAAZZ-controlled bank accounts available to receive stolen funds from cyber thieves.

QQAAZZ advertised its services as a ‘global, complicit bank drops service’ on Russian-speaking online cybercriminal forums where cybercriminals gather to offer or seek specialised skills or services needed to engage in a variety of cybercriminal activities. The criminal gangs behind some of the world’s most harmful malware families (e.g.: Dridex, Trickbot, GozNym, etc.) feature among those having benefited from the services provided by QQAAZZ.

International police cooperation coordinated by Europol was central in bringing the perpetrators to justice who were all located in different geographical locations around the world.