The Alicante Civil Guard’s Team @ dismantled a criminal network in Vega Baja and Murcia that specialized in cyber fraud, employing phishing schemes and SIM swapping or SIM card cloning. Authorities arrested three leaders, including an employee of a mobile phone shop in Orihuela, along with 13 individuals who posed as so-called mules to funnel fraudulent money orders into their accounts in exchange for commissions.
The Civil Guard confirmed that the gang had generated substantial losses for victims across several provinces. Bank accounts held by victims were drained of more than 126,000 euros. Arrests included one person in detention, and participants faced varying charges such as membership in a criminal organization, fraud, extortion, money laundering, weapon possession, and drug trafficking.
Team @ began their investigation after complaints from a well-known Spanish bank in March. This led to what authorities labeled the operation Rulsimlute, revealing a tightly coordinated group that combined two common cybercrime methods in a single operation.
The group used phishing to harvest personal data from potential victims and disseminated mass emails that impersonated a recognized Spanish bank to deceive targets.
They then combined this with SIM swapping or the cloning of SIM cards. During this phase, one of the gang’s leaders, who worked at a mobile phone shop in Orihuela, arranged for a duplicate SIM card linked to a victim’s phone number. With control of the victim’s digital banking, the syndicate fraudulently transferred large sums into accounts held by economic mules, enabling further transfers and withdrawals.
The crime network was led by a 40-year-old Spanish mobile shop employee and two Moroccan brothers, aged 35 and 33, who acted as the operational heads, coordinating mule recruitment and managing finances, according to the Civil Guard.
Below the leadership level, a wider network of mules provided bank account details to receive fraudulent transfers. These mules sometimes conducted withdrawals or purchases from bank accounts within gaming rooms located in Vega Baja and Murcia. In exchange for financial compensation, they surrendered the defrauded funds to the ringleaders.
Since March 30, the operation has resulted in 16 arrests linked to the case, beginning with the mobile shop employee. The group’s leader in Orihuela was sought at his residence in Elche. Ten other economic mules were apprehended in subsequent operations, and a few days later, on May 5, the two Moroccan brothers were arrested and their homes searched in Orihuela and Redovan.
The operation culminated on June 1 with the arrest of three additional economic mules. In total, 13 mules—ranging from 26 to 48 years old and of Spanish, Uruguayan, and Brazilian nationalities—were identified as part of the scheme.
The Civil Guard recovered a range of items, including multiple mobile devices, SIM cards, 40 ecstasy pills, five pounds of marijuana, cash totaling 2,059 euros, an electroshock device, two ready-to-use short firearms, and sixteen rounds of ammunition. Several bank accounts linked to group members were blocked, and authorities reported that the operation recaptured more than 90,000 euros that had been misappropriated through fraudulent activity.
Investigators demonstrated that the network benefited from more than 126,000 euros across multiple regions, including Ciudad Real, Salamanca, Navarra, Zamora, Santa Cruz de Tenerife, and Huelva. While the operation stopped at the time of reporting, officials noted that the number of victims could rise further once all seized documents were thoroughly examined.