A joint law enforcement operation involving U.S. and Dutch authorities has led to the seizure of 39 domains and servers tied to the Pakistan-based HeartSender cybercrime group, also known as Saim Raza and the Manipulators Team. The takedown occurred on January 29, 2025.
HeartSender has been operating since 2020, selling phishing tools, malware, and fraud kits to cybercriminals, leading to over $3 million in financial losses in the U.S. The group also provided training to its customers, marketing their tools as “fully undetectable” by antispam software.
The seized domains were used to facilitate business email compromise (BEC) scams, allowing cybercriminals to steal credentials and redirect financial transactions. According to the U.S. Department of Justice (DoJ), criminals exploited these tools to deceive businesses into making payments that were then funneled into fraudulent accounts.
DoJ stated that the seizure of these domains aims to disrupt ongoing criminal activity and prevent further proliferation of these tools.
The Manipulators group openly advertised its services on cybercrime forums, and by 2021, its key members had established WeCodeSolutions in Lahore, Pakistan, in an attempt to legitimize their earnings. Investigative reports revealed that employees unintentionally exposed their affiliations through social media activity.
The Manipulators group neglected its own security, leading to user data leaks. HeartSender’s web-hosted platform exposed a large volume of sensitive user information, including customer credentials and email records of HeartSender employees. Additionally, the group’s internal computers were reportedly infected with password-stealing malware, leading to further data breaches and credential theft.
To assist potential victims, Dutch police have launched a website where users can check if their data was compromised by the HeartSender group.
The development follows the takedown of online criminal marketplaces such as Cracked, Nulled, Sellix, and StarkRDP as part of a coordinated law enforcement operation dubbed Talent towards the end of January 2025.
Comments