Operation Kaerb dismantles iServer phishing-as-a-service platform; 17 arrested
Summary
A 2024 international operation dismantled iServer, a phishing-as-a-service platform used to steal credentials and one-time codes to unlock stolen devices. Authorities arrested 17 people and seized the platform’s domain.
Key points
- Group-IB supported Operation Kaerb, coordinated by Europol and Ameripol with partners in Europe and Latin America.
- Authorities arrested 17 people across Argentina, Chile, Colombia, Ecuador, Peru, and Spain, and seized iServer’s domain and backend assets.
- Investigators attributed about 1.2 million targeted devices and 483,000 victims worldwide to the platform.
- iServer generated brand-mimicking phishing pages; SMS links led targets through redirectors to credential and, when needed, one-time-code prompts.
- The platform validated submissions in real time and returned confirmed data to operators, who used it to unlock and resell stolen devices.
- Group-IB says the takedown disrupted the service and reduced near-term smishing and credential harvesting against cloud-based mobile services in Spanish- and Portuguese-speaking markets.
Article Details
- Event Type
- International law-enforcement takedown of a phishing-as-a-service platform
- Impact
- Operation Kaerb took iServer offline, seized its domain and backend assets, and resulted in 17 arrests. Investigators attributed approximately 1.2 million targeted devices and about 483,000 victims worldwide to the platform.
MITRE ATT&CK
People
Vendors
Products
Countries
Argentinadevices and about 483,000 victims worldwide to iServer; coordinated raids led to 17 arrests across Argentina, Chile, Colombia, Ecuador, Peru, and Spain, and the platform’s domain was seized.Chileand about 483,000 victims worldwide to iServer; coordinated raids led to 17 arrests across Argentina, Chile, Colombia, Ecuador, Peru, and Spain, and the platform’s domain was seized.Colombiaabout 483,000 victims worldwide to iServer; coordinated raids led to 17 arrests across Argentina, Chile, Colombia, Ecuador, Peru, and Spain, and the platform’s domain was seized.Ecuadorvictims worldwide to iServer; coordinated raids led to 17 arrests across Argentina, Chile, Colombia, Ecuador, Peru, and Spain, and the platform’s domain was seized.Peruworldwide to iServer; coordinated raids led to 17 arrests across Argentina, Chile, Colombia, Ecuador, Peru, and Spain, and the platform’s domain was seized.Spainto iServer; coordinated raids led to 17 arrests across Argentina, Chile, Colombia, Ecuador, Peru, and Spain, and the platform’s domain was seized.