LAHORE: The National Cyber Crime Investigation Agency (NCCIA), in coordination with US Federal Bureau of Investigation (FBI) and Dutch police, arrested 21 suspects involved in cybercrime operations and digital fraud worth millions of dollars in Multan and Lahore.

The NCCIA conducted raids in Lahore’s Bahria Town and Multan on May 15 and 16 that discovered the ‘HeartSender Group’ - a criminal network that not only executed financial scams but also developed and sold cybercrime tools globally.

The arrested suspects include Rameez Shahzad alias Saim Raza (mastermind in Lahore), Muhammad Aslam (Rameez’s father), Atif Hussain, Muhammad Umar Irshad, Yasir Ali, Syed Saim Ali Shah, Muhammad Nowsherwan, Burhanul Haq, Adnan Munawar and Abdul Moiz from Lahore and Hussnain Haider (Multan operations head), Bilal Ahmad, Dilbar Hussain, Muhammad Adeel Akram, Awais Rasool, Usama Farooq, Usama Mehmood and Hamad Nawaz from Multan.

According to documents available with Dawn, the gang operated as a cybercrime provider. Its operations included maintaining online marketplaces that sold phishing kits, scam page templates, and email extractors - all advertised as ‘fully undetectable’ by security software. More alarmingly, the group produced detailed video tutorials teaching buyers how to use these tools against victims.

21 held in Lahore, Multan for international scams, cybercrime tools sale

Rameez Shahzad allegedly ran the technical and business operations from House No 75 and House No 797 in Gulbahar Block, Bahria Town, Lahore, while coordinating with Multan-based partner Hussnain Haider who managed operations from Street No. 1 near Prime Mart, Fatima Avenue, Multan.

During raids on these properties, the teams recovered 32 digital devices, including servers containing evidence linking the group to over 11,000 victims worldwide. Luxury vehicles, including a Lamborghini Urus were seized, along with property documents showing investments in Dubai real estate.

NCCIA Additional Director Abdul Ghaffar said the group’s tools were connected to more than $50m in losses in the United States alone, with European authorities investigating 63 additional cases.

“This wasn’t just a scam operation - it was essentially a cybercrime university that empowered fraudsters globally,” Ghaffar told at a press briefing.

During interrogation, Muhammad Aslam admitted his son’s criminal activities, telling investigators: “My son has been looting money from across the globe through these online activities.” Digital evidence recovered included WhatsApp and Telegram chats detailing phishing campaigns and financial fraud methodologies.

Authorities have frozen assets worth 480m, including properties in Lahore, Multan and suspected overseas holdings. All suspects have been placed on the Exit Control List as investigators work to trace 142 cryptocurrency wallet addresses used by the network. With several key suspects still at large, including associates in Layyah and Mianwali, Interpol is preparing red notices.

Multan NCCIA registered case under the Prevention of Electronic Crimes Act (PECA) 2016 and PPC against Rameez , Syed Saim Ali Shah, Muhammad Nousherwan and others Anti-Terrorism Court also approved a seven-day physical remand of the suspects.

Published in Dawn, May 18th, 2025