Agents from the National Police and the Civil Guard have participated in an international operation together with EUROPOL and AMERIPOL to dismantle an international criminal structure dedicated to unlocking stolen high-end mobile phones. They managed to unlock the phones by sending an SMS that pretended to be from the manufacturer of the device and ended up stealing the digital life of the victims.
Although it is not expressly mentioned in the press release, almost all of these handsets were Apple iPhones. The good thing about iPhones is that they have a locking system that has been improved over time and prevents a stolen handset from being used. Even police authorities in many countries have problems accessing these handsets in cases of murder or manslaughter. For this reason, having the collaboration of the legitimate owner is vital to access the phone. With this premise, the gang that unlocked 1.3 million stolen iPhones with an ingenious trick was born.
KAERB operation in Spain, Argentina, Colombia, Chile, Ecuador and Peru
The National Police has announced the conclusion of this operation involving a total of 17 people in six countries and 28 searches. A total of 921 electronic devices have been seized. If we focus on Spain, three people have been arrested and three searches have also been carried out (47 mobile phones, 6 tablets and 3 laptops).
The investigation began in July 2022 following information sent by EUROPOL warning of the existence of “a computer platform dedicated to the illegal unlocking of high-end electronic devices, mainly mobile phones, and which operated mainly in Spanish-speaking countries.”
The method of operation is simple but elaborate. An SMS was then sent to the legitimate owners whose terminal had been stolen and they were offered a link to a website that pretended to be Apple for the recovery of the terminal. Before that, social profiling of the victims had been carried out to obtain personal information. All this was combined with OSINT techniques to obtain the victims’ telephone numbers to send them the malicious SMS.
The messages were of this type (web links have been omitted for security reasons):
You have 24 hours to contact us about your lost iPhone 12 Pro.
Please visit our website via the link:
(web)
—
Your lost iPhone 13 has been connected to the internet.
To locate or block this device, please visit:
(web)
Apple Support.
—
Your lost iPhone 13 has been connected to the internet.
To locate or block this device, please visit:
(web)
Apple Support.
—
Dear Customer,
Your lost iPhone 13 is online.
View location:
(web)
Sincerely,
Apple Support.
In the false hope of gaining access to their stolen devices, many victims ended up hacking into the device, entering their iCloud details and thus allowing the gang to unlock their phones. This data was then sold to the users who had purchased the stolen phones. It is estimated that they used a total of 5,300 fake websites, illegally unlocking around 1,300,000 high-end devices, around 30,000 of them in Spain.
The operation has allowed the service provided internationally to be deactivated and the servers to be dismantled by shutting down. The traffic has now been redirected to a domain controlled by the National Police. The iServer platform, as it was known, was the central point of the network and had been operating for about 5 years. The victims, as we have already mentioned, have been from Chile 77,000, Colombia 70,000, Ecuador 42,000, Peru 41,500, Spain 30,000, Argentina 29,000 and other countries 193,500.
