FBI dismantles massive China-based cybercrime network responsible for $1.9B in losses

Jun 13
2 min read

Key Findings

FBI, Google, and Lumen Technologies dismantled Outsider, a China-based cybercrime network responsible for $1.9 billion in losses across 55 countries
Operation Ghost Hook seized multiple domains, admin servers, a Shopify storefront, approximately $100,000 from payment wallets, and thousands of domains
Outsider provided phishing kits as a subscription service starting at $88 per week, enabling criminals to target hundreds of thousands of victims
The network used AI tools like Google Gemini to generate custom phishing code and lures impersonating trusted brands
Nearly 3.9 million stolen credit cards were traced to Outsider's phishing domains

Background

Outsider operated as a phishing-as-a-service enterprise starting in July 2023, providing cybercriminals with the tools and infrastructure needed to launch large-scale fraud operations. The network distributed phishing kits that allowed scammers to create convincing fake websites impersonating legitimate companies. Rather than conducting attacks themselves, the group profited by selling subscriptions to other criminals, creating a scalable business model that attracted numerous threat actors globally.

Operation and Scope

Outsider's phishing kits enabled criminals to craft targeted lures claiming victims had missed packages, unpaid tolls, parking violations, brokerage account issues, or wireless carrier reward problems. The software allowed scammers to request multiple forms of verification including SMS codes, PINs, emails, and app-based authentication. This multi-layered approach was designed to defeat various security measures and steal credit card numbers, banking credentials, and personal data. The operation impacted victims in 55 countries, with significant activity targeting the United States.

Technical Innovation and AI Integration

What set Outsider apart was its integration of artificial intelligence. The network actively encouraged customers to use Google's Gemini and other AI platforms to generate custom phishing code and create personalized attack campaigns. This approach allowed cybercriminals without deep technical expertise to quickly develop new phishing lures and corresponding fake websites. The AI integration dramatically lowered the barrier to entry for would-be scammers and accelerated the pace of attack variations.

Law Enforcement Action

The coordinated takedown, dubbed Operation Ghost Hook, involved seizing Outsider's core administrative servers and cutting off their command infrastructure. Authorities gained access to a Telegram bot the group used to communicate with customers, providing intelligence on the cybercrime network's client base and operations. The FBI also recovered approximately $100,000 from Outsider's payment wallets and targeted thousands of domains registered through U.S.-based providers. The operation was conducted under Operation Riptide, an ongoing FBI campaign targeting cybercriminal infrastructure and financial networks.

Ongoing Challenges

Despite the takedown, cybersecurity experts acknowledge that phishing attacks of this type remain prevalent and have been spreading for years. Google is working with major carriers AT&T, T-Mobile, and Verizon to intercept phishing-related spam messages before they reach customers, but this reactive approach has limitations. Google's general counsel emphasized that litigation alone cannot solve the problem and called for new legislation to address evolving cyber threats. The FBI does not know the real identities of those behind Outsider, though evidence suggests the operation was supported by multiple overlapping cybercrime groups performing different roles.

Sources

https://cyberscoop.com/outsider-cybercrime-network-takedown-china-fbi-google-lumen/
https://x.com/TheCyberSecHub/status/2065554810972385752
https://www.linkedin.com/posts/cybercureme_fbi-takes-down-massive-china-based-cybercrime-activity-7471320503874396160-RLoB
https://ground.news/article/google-sues-cybercrime-network-that-used-gemini-for-financial-scams_a57881