Law enforcement agencies spanning three countries and across the Atlantic have successfully dismantled a significant Spanish cybercrime network and its intricate money laundering apparatus. On July 13, **Spain's national police** announced the takedown of an Iberian criminal gang comprising over 70 known individuals, operating through 19 registered companies and nearly 1,000 financial accounts. The majority of these individuals were instrumental in laundering cybercrime proceeds. The core hackers, operating from two "nerve centers," perpetrated various attacks, including man-in-the-middle (**MitM**) attacks, CEO impersonation scams, social engineering attacks involving fake invoices, and fraudulent investment platforms. Cumulatively, they managed to steal at least €140 million ($161 million), with authorities linking €61 million to CEO impersonation attacks in 2024 alone. ## Arrests & Seizures During the operation, police froze and recovered €3 million ($3.4 million) in illicit funds, which have since been returned to victims. Authorities seized 15 computers and 170 smartphones from the gang's operational hubs. The scale of this takedown is substantial, comparable to recent **Europol** stings, though smaller than some large-scale cybercrime operations in Southeast Asia. Four central members of the scheme were arrested. This included an unnamed "main suspect" who had recently relocated from Spain to Porto, Portugal, and was apprehended alongside his partner. Another primary suspect, accused of running a fraud agency from his home and managing the group's financial infrastructure as a "mule herder," was arrested while traveling in Panama. Like many similar operations, this cyber fraud scheme was bottom-heavy, with only four individuals identified as involved in malicious cyber activity, supported by 67 or more underlings acting as money mules. ## Money Laundering in Cybercrime Cyber gangs not focused on cryptocurrency often go to great lengths to move and extract cash beyond the reach of law enforcement, or at least at a pace that evades capture. This can involve rapid withdrawals from hundreds of ATMs or exploiting clever loopholes. **Matt Burch**, principal security researcher at **Atredis Partners**, notes that "more often than not, [money mules] are illegal immigrants." In this particular case, the operation's leaders recruited international citizens to travel to Spain and serve as mules. Burch explains, "Part of the reason behind that is because if they're arrested, they typically get deported before they're interrogated by authorities, which insulates the core group of people" running the operation. These mules were compelled to register companies through which they could open new bank accounts. Illicit revenue flowed from the hackers to the mules via 19 corporations, 120 merchant accounts, and 800 bank accounts. These bank accounts were layered, with funds routed through multiple financial tiers and across several countries before physical withdrawal. **Louis Eichenbaum**, federal chief technology officer (**CTO**) at **ColorTokens**, emphasizes the importance of dismantling financial structures: "Cybercriminals can replace servers and domains quickly, however, rebuilding a trusted financial network of bank accounts, shell companies, and money mules, is much harder." He adds, "Spain's operation should create meaningful short-term disruption, but its lasting impact will depend on whether authorities can convert the seized financial intelligence into additional arrests, asset recovery, and action against the group's remaining infrastructure." ## Policing Isn't Enough on Its Own Ideally, Spain's latest law enforcement success will contribute to its slightly declining cybercrime rates, a trend observed in some other parts of the world. The country's **Ministry of the Interior** reported a 1.6% drop in Spanish cybercrime in 2024 after years of consistent growth. **Andrey Leskin**, CTO at **Qrator Labs**, who specializes in botnet takedowns and threat patterns, argues that "large-scale law enforcement takedowns are undoubtedly valuable, but they are unlikely to provide a permanent solution to cybercrime." Leskin highlights the asymmetry between attackers and defenders: "Technology evolves much faster than regulatory frameworks and enforcement capabilities, creating an inevitable period of asymmetry." He also points out the complexities of cross-jurisdictional cybercrime: "Another major challenge is that the victim, the attack infrastructure, and the threat actor are often located in different jurisdictions. An organization may be targeted in one country, the attack infrastructure hosted in another, and the operators located in a third. Collecting evidence, coordinating investigations, and ultimately prosecuting those responsible becomes an extremely complex international effort." Ultimately, Leskin advocates for a shift towards "ecosystem security." He argues that long-term progress against cybercrime requires not only dismantling operations after they emerge but also reducing the number of vulnerable devices online, improving baseline security requirements for device manufacturers, strengthening collaboration among vendors, Internet service providers, security companies, and law enforcement, and making it significantly harder to establish and sustain large-scale cybercriminal operations in the first place.