Archetyp Links

Light Mode

Article Details

What is known about PF operation that arrested suspects of billionaire attacks against banks

Published on September 14, 2025

The Federal Police arrested on Friday, 12, eight suspects of hacker attacks against financial institutions.According to investigations, the criminal organization, which has already taken over $ 1.2 billion from invasions, intended to attack Caixa Econômica Federal, which would affect resources for federal government programs and other public budget credits, but the action was barred. The group detained on Friday denies the accusations.Prior to the arrest of the eight suspects on Friday, the PF Cyber ​​Crime Suppression Police Station had already detained four people on suspicion of participation in the attacks. Computer seized by the feds in the house in the Patriarch city, in the East Zone, which was accused of millionaire thefts against banks Photo: Federal Police How does the criminal organization acted? Advertising since June 30, the criminal organization has acted on two occasions.The invasions reached interbank settlement accounts, the PI accounts, in which reserve amounts are deposited for the intermediation of payments between financial institutions.The first attack was against C&M, service provider accredited by the Central Bank.The biggest damage was Bank BMP, which suffered loss of R $ 479 million. Advertising The second attack took place against Sinqia, another accredited by the Central Bank.R $ 710 million were diverted, of which R $ 583 million were blocked by the BC.The biggest damaged, this time, was the HSBC bank. How was the operation that avoided attack on the box? The gang would have co -opted at least one Caixa employee, which allowed it to access the bank system.This Friday, the PF was warned by a Caixa manager that a group of people would obtain credentials for external access to the bank's system at an agency in Brás, central São Paulo. According to PF investigations, the suspects were people who identified themselves as Sethh 7, RBS and BA.They would be responsible for billionaire thefts on accounts maintained by the Central Bank, in the sector called instant payment arrangement. Also on September 12, according to the investigation, in order to make theft of resources viable, "there was the attendance of people to subtract the machine to the Caixa agency."A Federal Police team went to the scene and accompanied the “subtraction of a notebook”. Advertising According to the investigation, the notebook was carried by the accused Fernando Vieira da Silva and Guilherme Marques Peixoto.Before being detained by the police, they passed the device to the occupants of another vehicle, which was followed by the PF to a house in Patriarch City, east São Paulo. The PF recovered the computer, which was connected and ready to start the attack.In the operation, which also seized cell phones and other computers, the police detained José Elvis dos Santos, Klaiton Leandro Matos de Paulo, Maicon de Souza Ribeiro Rocha, Marcos Vinícius dos Santos, Nicollas Gabriel Pytlak and Rafael Alves Loia. The defenses of the suspects were not located by the report. What was the destination of the values ​​stolen? According to conversations obtained by the investigation, the criminal organization acted with the rapid transformation of encrypted values, which were sprayed into thousands of fintech accounts, closed and oranges companies.Then the funds were sent to wallets abroad. Advertising "This is a criminal organization, which has been acting in subtraction of funds from the instant payment arrangement, with improper access to PI accounts, maintained by financial institutions in the Central Bank," says the PF.Also according to the PF, in the messages the hacker group confesses that one of its members executed the attack on the system of the company Sinqia, which "enabled the realization of financial operations of Pix, culminating in estimated financial loss of $ 420 million."Hacker BA would be responsible for building the means of access to the Pix system, subtracting values ​​of bank reserve accounts in the Central Bank.He would have introduced structural vulnerabilities to enable new attacks.In the messages, RBs, treated as "Rafa", confirms that he the other members were responsible for the attacks on Sinqia and the Central Bank (C&M). Another of the accused confesses in a message to "the password" that "rotates the pix to the fraud."One of the accused said he walked that the whole structure to perform the 'work' had already been made possible by talking to RBS, who also calls "leadership."