DIICOT: Russian hybrid threat exploded in 2024

The number of hybrid attacks from the Russian Federation on our country increased in 2024, according to the activity report for last year of the Directorate for the Investigation of Organized Crime and Terrorism (DIICOT) posted on the website of the public institution.

"A new element is the recruitment of contractors through platforms such as Telegram, offering them amounts of several hundred to several thousand dollars. The objectives of these attacks include testing the defense capabilities of NATO states and identifying infrastructural vulnerabilities," DIICOT prosecutors claim in the cited document.

They show that, from 2022 until the end of last year, over 50 incidents were reported in 13 European countries, including Romania, with several types of crimes being reported, including espionage, diversion, vandalism, cyberattacks and disinformation campaigns (fake news).

DIICOT prosecutors also show: "Compared to previous years, there is an upward development of organized crime, favored, in particular, by technological evolution and increased internationalization, but also a transformation in the evolution of local organized crime groups, determined by the outbreak, in the proximity of Romania, of the armed conflict between the Russian Federation and Ukraine. This context has generated a change in the criminal behavior of criminal groups, in terms of areas and modes of operation, in the sense that organized crime groups are diversifying their criminal portfolios, in order to adapt to the transformations in the social and economic environment. This versatility necessarily implies adequate and coherent action by the state to effectively counter organized crime".

They also claim that, with regard to crimes targeting national security, they have observed online radicalization and increased propaganda by extremist organizations, especially after Hamas terrorists attacked Israel on October 7, 2023, taking several hostages, which led to the armed conflict in the Gaza Strip and the intensification of terrorist risks globally. The DIICOT report shows that there is a radicalization of Romanian citizens, especially minors and young people, and an increase in the risk of the "lone wolf" phenomenon, where individual attackers use simple methods of attack (vehicles, bladed weapons, improvised explosive devices). Furthermore, prosecutors from the respective Prosecutor's Office have observed a slight increase in the number of cases regarding the disclosure of classified information, notified by institutions with responsibilities in the field of national security, compared to previous years.

• Identity theft and phishing - the main cybercrimes

As for cybercrime, the DIICOT report states that in 2024, 2914 new cases were registered, which increased to 6983 cases the number of cases to be resolved by prosecutors.

The cited document shows: The trend of organized crime groups, made up of Romanian and foreign citizens, specializing in crimes under the e-commerce regime - skimming activities, in

compromising and defrauding electronic payment instruments outside the territory of Romania has been maintained, at the territorial level taking place, in general, only the planning of criminal activities, the initiation of the group, the recruitment of certain members, the manufacture, testing and transmission abroad of equipment or certain skimming hardware/software components and finally the collection of the criminal product.

At the same time, prosecutors have identified new ways of operating for criminals in the field of computer science. The first refers to SIM Swap attacks (SIM card cloning). This type of attack is a form of "Identity theft", its aim being to control the mobile phone number by cloning the SIM card. Therefore, the cybercriminal takes control of the victim's mobile phone number, through various methods, in order to obtain access codes related to online platforms that have implemented two-step authentication (2FA), whether it is banks, social media or email providers. One of the most common methods of transmitting 2FA codes is via SMS.

The second concerns the theft of bank cards from abroad followed by the transmission of the data inscribed on them via NFC technology to individuals in Romania, who use them in real time to make payments through POS devices, obtained in the name of commercial companies established for fraudulent purposes. The amounts transferred from the victims' accounts to the commercial companies' accounts through POS payments are subsequently withdrawn in cash by members of the criminal group in Romania.

DIICOT prosecutors also point out: "In 2024, the number of phishing attacks increased, targeting almost all banking institutions in the Romania. The criminal methods of collecting access data to internet banking applications have constantly diversified throughout the year. One of the most innovative forms of data acquisition was found in the creation of new accounts on mobile phone applications as well as by illegally accessing existing ones, followed by securing access to the victims' phone numbers. Having control over the phone numbers, the perpetrators managed to obtain the credentials of internet banking accounts and successfully carry out illegal operations to transfer amounts of money from the accounts".

Another trend in the field of cybercrime revealed in the report also concerns computer fraud consisting in accessing virtual wallets and transferring cryptocurrencies without the right, ransomware-type attacks - cryptolocker in order to disrupt the functioning of certain computer systems, by encrypting data and thus restricting the legitimate owner's access to the attacked server, followed by transferring the respective data to computer systems controlled by the attackers and conditioning the decryption operation by paying amounts of money in cryptocurrency in certain virtual wallets but also threatening to publish the data if the ransom is not paid, Business Email Compromise or CEO Fraud attacks, crimes that seriously affect the activity of some companies or public and private institutions, generating losses of millions of euros by diverting payments to other accounts of cybercriminals. At the same time, new cases of computer fraud and fraudulent financial operations were registered through the use of confidential data related to either bank cards or online banking accounts, data/credentials obtained through technical methods of phishing operation, respectively through cloning and use of fake web pages related to various financial institutions or online e-commerce platforms. Furthermore, DIICOT prosecutors recorded a significant increase in fraud involving investment platforms in cryptocurrencies or stock market transactions (Investment Fraud / Investment Scam), acts through which attackers induce victims to install remote access applications on their mobile devices, followed by accessing online banking applications, fraudulently transferring funds to other bank accounts controlled by the attackers, but also by obtaining bank loans in the victims' names, also through applications, immediately followed by the illegal transfer of these funds.

• The number of cases regarding the violation of the Customs Code, increasing

The DIICOT report also records the fact that last year another 306 files were registered with the object of crimes in the sphere of economic and financial crime, including the tax evasion crimes that it received for investigation under Law 126/2024, if the case entered into the scope of an organized criminal group, as defined in Art. 367 paragraph 6 of the Criminal Code and if, regardless of the number of concurrent crimes, a material damage of more than 10 million lei was caused.

By type of crime, in 2024, the detailed statistical situation of DIICOT is presented as follows:

- tax evasion crimes: Of the 80 cases to be resolved in 2024, of which 13 cases newly registered in the reference period, a number of 26 cases were resolved, which represents a decrease of 31.58% compared to 2023 in resolved cases, a decrease of 29.82% in cases to be resolved and a reduction of 58.06% in newly registered cases compared to 2023.

- crimes provided for by the Customs Code:

Of the 278 cases to be resolved in 2024, of which 89 cases newly registered, a number of 59 cases were resolved in the reference period, which indicates a decrease of 39.80% in cases resolved in 2023, a reduction of 11.18% of cases to be resolved and an increase of 2.30% in newly registered cases.

- with regard to other economic crimes, there was an 8.51% increase in the number of new cases compared to 2023.

Based on all the data in the report, it can be said that for DIICOT, 2024 was marked by significant changes in crime and national security. Although the terrorist threat remains low, the dangers related to radicalization and hybrid attacks are increasing, and cybercrime has experienced a diversification of attack methods.