Four cybercriminals have been apprehended in Brazil, with an additional three facing charges in Europe, following a collaborative investigation by Brazilian and German federal police. The group is accused of exploiting a critical vulnerability within a service provider's system, which allowed them to illicitly withdraw funds from **Commerzbank** customer accounts. The elaborate scheme, which unfolded over four days in November 2023, resulted in an estimated loss of €30 million. ### The Attack Vector: A Service Provider Flaw While official statements from the **Brazilian Federal Police** and Germany's **BKA** did not initially name the affected financial institution, Brazilian media identified it as **Commerzbank**, a prominent European bank. **Commerzbank** has since confirmed the incident, stating that while clients were impacted by the fraudulent activity, no customers suffered financial losses. "The fraud case is known and dates back to 2023. Due to technical issues at a service provider, unauthorized direct debits were made from customer accounts. There was no financial loss to customers. We cooperated closely and extensively with the authorities," a **Commerzbank** spokesperson clarified. German authorities revealed that the hackers leveraged a software vulnerability introduced by a faulty update within the payment and transaction-processing system of a financial institution. This allowed the attackers to initiate numerous unauthorized withdrawals from various German online banking accounts. ### Global Money Laundering Network Uncovered The stolen funds were then funneled to Brazil through an extensive network designed to obscure their origin. Investigators found that the largest portion of the funds was cashed out in Brazil, with smaller amounts distributed across four European countries. Police identified three additional suspects in Europe, who will be prosecuted in Spain and Bulgaria. The criminal network utilized pass-through accounts, shell companies, various payment institutions, virtual-asset platforms, and even payment cards issued without the beneficiaries' consent to move and conceal the illicit proceeds. ### Operation Klonen: Arrests and Seizures Yesterday, the **Brazilian Federal Police**, with crucial support from Germany’s **BKA**, launched "Operation Klonen." This operation involved executing 21 search-and-seizure warrants across seven Brazilian cities.  The coordinated effort led to the arrest of four suspects under preventive detention warrants in Rio de Janeiro, Guarulhos, Goiânia, and Carapicuíba. Brazilian authorities also uncovered that one of the suspects had used some of the illicit funds to finance a political campaign in 2024. A Brazilian federal court has ordered the seizure of financial assets, vehicles, and real estate valued at up to R$106 million (approximately $22.4 million USD). The arrested individuals face a range of charges, including aggravated theft through electronic fraud, participation in a criminal organization, and money laundering.