'Boss Scam', Handled Via China And Pakistan, Busted In Gujarat

In a major breakthrough against international cybercrime networks, the Ahmedabad City Cyber Crime Branch has busted a sophisticated syndicate running the infamous 'BOSS Scam'. The operation, conducted under the leadership of Police Commissioner Anupam Singh Gehlot and senior officers, led to the arrest of two key operatives traced from West Bengal. 

The joint technical analysis conducted with the Indian Cyber Crime Coordination Centre revealed an intricate cyber infrastructure spanning China, Pakistan, Hong Kong, and India. By neutralising the operation, police officials secured over 10,000 compromised devices and saved citizens from potential financial losses running into crores of rupees.

The fraud mechanism involved impersonating corporate executives or Reserve Bank of India officials. Attackers sent malicious zip files containing executable malware to company employees via WhatsApp or email. Once opened on WhatsApp Web, criminals hijacked the session, altered the executive's contact details, and instructed finance teams to make urgent wire transfers. Investigation into nearly 4,500 SIM cards recovered during the bust linked the infrastructure to 251 formal complaints across 26 states, spanning financial fraud, social media crimes, and systemic hacking.

Unmasking Local Network And Global Links

The two arrested individuals, identified as Imran Ali Piyada and Injamul, provided the crucial local telecom bridge for the syndicate. Imran, a point-of-sale agent for major telecom service providers, exploited customer biometric data to covertly activate dummy SIM cards. Over five years, he generated over 21,000 one-time passwords (OTPs) for e-commerce or gaming platforms and roughly 900 OTPs for WhatsApp activations, earning lakhs by selling them online. Injamul worked in coordination to manage these fraudulent lines and digital communication routes. Police seized seven mobile handsets and a router during the raid.

Technical findings confirm that the malware was engineered by Chinese cyber syndicates and deployed through call centres based in Islamabad, Pakistan. The fraudsters routed compromised bank transactions through China-based virtual private networks to conceal their identities.