In a major international crackdown, U.S. and Dutch authorities have announced the complete dismantling of a Pakistan-based cybercrime network accused of selling hacking tools and facilitating fraud worldwide.
DOJ Identifies Network as ‘Heartsender’
The U.S. Department of Justice (DOJ) has identified the cybercrime ring as ‘Heartsender’, allegedly led by Saim Raza. While the DOJ has not disclosed details about Raza’s current whereabouts, it confirmed that the network had been operating online marketplaces for over a decade, providing cybercriminals with tools for counterfeiting, malware distribution, and large-scale financial fraud.
Operation ‘Heartblocker’ Shuts Down Key Platforms
As part of Operation ‘Heartblocker’, law enforcement agencies seized 39 domains and associated servers used by the group. Authorities estimate that the platform caused over $3 million in financial losses in the U.S. alone.
U.S. Attorney Nicholas J. Ganji highlighted the impact of these operations, stating that the fraudsters not only targeted businesses but also individuals, inflicting significant financial and personal damage.
“Even though these criminals operated from overseas, their platforms made it easy to distribute malicious hacking tools. Today, we have severely disrupted their ability to continue harming others,” Ganji added.
Heartsender’s Role in Phishing and Email Fraud
The cybercrime network specialized in phishing kits, which were used to create fake login pages resembling legitimate platforms such as Microsoft 365, Yahoo, AOL, Intuit, and iCloud. These deceptive pages tricked users into entering their credentials, which were then stolen and sold on the black market.
Their flagship service, Heart Sender, was an advanced spam delivery system that enabled criminals to send large volumes of fraudulent emails while bypassing security filters. The software was available as both a web-based platform and a downloadable Windows program.
Following the takedown, the official website, heartsender.com, now displays a seizure notice confirming its shutdown.
Saim Raza Trained Cybercriminals and Sold Fraud Tools
According to the DOJ, Saim Raza not only sold hacking tools but also provided training to criminals on how to use them. His network actively promoted cybercrime by uploading instructional videos on YouTube, demonstrating spoofing techniques and identity theft methods.
Raza’s team marketed their tools as “Fully Un-Detectable” (FUD), meaning they could evade detection by cybersecurity software, including antivirus programs and anti-spam filters.
Business Email Compromise (BEC) and Financial Fraud
The cybercrime group specialized in Business Email Compromise (BEC) scams, a tactic used to deceive companies into transferring funds to fraudulent accounts. Once the victim’s credentials were stolen, they were used for further financial fraud.
Dutch authorities played a crucial role in the crackdown and have since launched a public website allowing users to check if their email credentials were compromised. Officials warned that stolen email addresses could be used for targeting both victims and their contacts.
Parallel Investigation: Arrests in Spain and More Seizures
As part of a separate but related operation, Operation Talent, authorities arrested two suspects in Spain and seized 17 servers and 12 domains linked to cybercrime marketplaces, including Cracked.io, Cracked.to, and Nulled.to.
These forums hosted millions of ads selling hacking tools, stolen credentials, and malware. The FBI’s Houston Field Office, along with Dutch law enforcement, led the investigation, with U.S. officials acknowledging the critical role of international partners in dismantling the network.
The Manipulaters: A Decade of Cybercrime Under Multiple Aliases
Investigations reveal that Saim Raza is the central figure behind ‘The Manipulaters’, a Pakistan-based cybercrime group engaged in phishing, spam operations, and financial fraud for over a decade.
Operating under various brand names—including Fudtools, Fudpage, Fudsender, and FudCo—the group specialized in developing tools designed to evade cybersecurity detection.
Despite previous claims of shutting down operations, The Manipulaters continued their illicit activities, drawing legal scrutiny.
Saim Raza’s Plea and Allegations Against Law Enforcement
In January 2024, Raza reached out to investigative journalist Brian Krebs, requesting the removal of past reports on his cybercrime operations. He claimed to have “left everything behind” and revealed that Pakistani authorities had filed a police report against him.
In his message, Raza alleged that law enforcement officials were primarily seeking bribes. Later, he claimed to have left Pakistan, though the credibility of this statement remains uncertain.
A Major Blow to Cybercrime Networks
The dismantling of Heartsender and related cybercrime forums marks a significant victory in the global fight against online fraud and hacking. Authorities continue to track individuals involved and have urged victims to remain vigilant against phishing scams and email fraud.
