Lahore: In a major international crackdown, Pakistan’s National Cyber Crime Investigation Agency (NCCIA), in collaboration with the U.S. Federal Bureau of Investigation (FBI) and Dutch Police, has dismantled a global cybercrime network operating out of Lahore and Multan.
In coordinated raids on May 15 and 16, 21 suspects were arrested for their alleged involvement in digital fraud and cybercrime schemes worth millions of dollars.
According to reports, the raids uncovered the operations of a criminal enterprise known as the “Heart Sender Group.” The group not only engaged in direct financial fraud but also provided cybercrime tools and services to perpetrators worldwide.
Key arrests include Rameez Shehzad alias Saim Raza—identified as the Lahore-based ringleader—along with his father Muhammad Aslam and several other associates. In Multan, Hussnain Haider, head of regional operations, was among the arrested.
NCCIA documentation reveals that the group functioned as a service provider for cybercriminals, offering phishing kits, fake webpage templates, and email extractors. These tools were marketed as “undetectable by security software” and sold online. Authorities also discovered that the group produced detailed video tutorials to instruct buyers on how to exploit the tools for fraud.
Rameez Shehzad operated the network's technical and commercial activities from two residences in Lahore’s Bahria Town, while Hussnain Haider managed operations from a residence near Prime Mart in Fatima Avenue, Multan.
The raids resulted in the seizure of 32 digital devices, including servers containing evidence linking over 11,000 victims globally to the group. Authorities also confiscated luxury vehicles, including a Lamborghini Urus, and documents related to property investments in Dubai.
According to NCCIA Additional Director Abdul Ghaffar, the group’s tools were linked to losses exceeding $50 million in the U.S. alone. Investigations into 63 related cases in European countries are currently ongoing.
“This wasn’t just a scam operation—it was effectively a ‘cybercrime university’ that empowered fraudsters worldwide,” Ghaffar said during a press briefing.
During interrogation, Muhammad Aslam, the father of Rameez Shehzad, admitted knowledge of his son’s criminal operations, stating, “My son was stealing money from around the world through online activities.”
Digital evidence includes WhatsApp and Telegram chats detailing phishing campaigns and methods of financial fraud.
Authorities have frozen assets worth Rs. 480 million, including properties in Lahore, Multan, and abroad. Investigations are ongoing into 142 cryptocurrency wallet addresses linked to the group. All suspects have been placed on the Exit Control List (ECL), while several key associates in Layyah and Mianwali remain at large. Interpol is in the process of issuing red notices.
NCCIA Multan has registered a case under the Prevention of Electronic Crimes Act (PECA) 2016 and the Pakistan Penal Code (PPC). The Anti-Terrorism Court has approved a seven-day physical remand for the suspects.
