INSPECTING ARCHIVED INTELLIGENCE (OUTDATED VERSION).

Russian Coms Call Spoofing Platform Fraud Case

| 2026-07-14 08:21 MEDIUM LOW PHISHING & SOCIAL ENGINEERING
JSON
Executive Summary
AI-generated
The National Crime Agency (NCA) has identified five individuals who were arrested in connection with the "Russian Coms" fraud platform case. The suspects, believed to be from different parts of London, are accused of operating a sophisticated scheme that allowed fraudsters to hijack victims' bank and telecoms accounts by bypassing multi-factor authentication. The NCA described the arrests as part of Operation Henhouse 5, which led to over 500 suspects being arrested and account freezing orders worth £9m ($12m) being imposed against them.
Technical Mitigations AI-generated
* Implement robust multi-factor authentication (MFA) protocols to prevent unauthorized access to sensitive accounts, such as bank and telecoms accounts. * Regularly update software and operating systems to patch known vulnerabilities and address potential exploitation by cybercriminals. * Use secure communication channels, such as end-to-end encrypted messaging apps like Telegram or Signal, for sensitive communications with customers or partners. * Conduct regular security audits and penetration testing to identify and fix weaknesses in the system, including those related to caller ID spoofing platforms.
Technical Observables Login Required
Indicators of Compromise (IoCs) Protected

Raw threat telemetry, malicious IP addresses, file hashes, and direct VirusTotal correlation are restricted to authenticated users.

Sign In to View 1 IoCs Create Free Account
ww•••••.agency
Intelligence Metadata
Actors / Malware / CVEs / Campaigns
Operation HenhouseOperation Henhouse
Target & Sectors
FIVE_EYES FIVE_EYES NORDICS NORDICS NORTH_AMERICA NORTH_AMERICA financefinance healthhealth retailretail telecommunicationstelecommunications
Incident Timeline
‎March 2024
Threat actors used the Russian Coms platform to target and charge hundreds of individuals in cryptocurrency for six-month contracts.
target_region Russian Federation
As the NCA revealed in March 2024, when it took down the Russian Coms platform , hundreds of criminals paid for six-month contracts, priced at £1,200 to £1,400 in cryptocurrency, to use its "flagship" services.
organisation NCA
As the NCA revealed in March 2024, when it took down the Russian Coms platform , hundreds of criminals paid for six-month contracts, priced at £1,200 to £1,400 in cryptocurrency, to use its "flagship" services.
‎January 2025
The trio ran a site called www.OTP.Agency, which charged a monthly subscription fee to fraudsters and helped them bypass multi-factor authentication (MFA) on victims' bank and telecoms accounts.
organisation Snaresbrook Crown Court
In January 2025 , three men were sentenced at Snaresbrook Crown Court after pleading guilty to operating a sophisticated scheme that helped fraudsters log in to victims’ bank and telecoms accounts.
financial £9 Stolen / Extorted Funds
Mor recently, Operation Henhouse 5 led to the arrest of over 500 suspects, as well as account freezing orders against £9m ($12m), and seizures of cash and assets worth £18.1m ($24.3m).
financial £18.1 Stolen / Extorted Funds
Mor recently, Operation Henhouse 5 led to the arrest of over 500 suspects, as well as account freezing orders against £9m ($12m), and seizures of cash and assets worth £18.1m ($24.3m).
financial $24.3 Stolen / Extorted Funds
Mor recently, Operation Henhouse 5 led to the arrest of over 500 suspects, as well as account freezing orders against £9m ($12m), and seizures of cash and assets worth £18.1m ($24.3m).
organisation MFA
The trio ran a site called www.OTP.Agency which charged a monthly subscription fee to fraudsters, helping them to hijack victims’ accounts by bypassing multi-factor authentication (MFA).
‎July 13
Threat actors used a "Russian Coms" platform to allow criminals to hide their identity by appearing to call from pre-selected numbers.
‎2026/07/14
Russian Coms was promoted on Telegram, Snapchat, and Instagram to target customers with its encrypted calls, web phone, and other services.
organisation Telegram
Promoted on Telegram, Snapchat, and Instagram, Russian Coms was available as a web app and as a handset, offering customers encrypted calls, a web phone, no-logs, international calls, voice-changing services, instant handset wipes, and 24/7 support.
organisation the National Crime Agency
The arrests relate to Russian Coms, which the National Crime Agency (NCA) described as a “group” but is also the name of a vishing platform used extensively by fraudsters until it was shut down in 2024.
organisation NCA
The arrests relate to Russian Coms, which the National Crime Agency (NCA) described as a “group” but is also the name of a vishing platform used extensively by fraudsters until it was shut down in 2024.
data_breach 500,000 unique phone numbers
​Until its shutdown, criminals used the platform to make over 1.3 million calls to 500,000 unique phone numbers across more than 107 countries, including the United Kingdom, the United States, New Zealand, Norway, and France, resulting in average losses of over £9,400.
organisation Europol
At the time, law enforcement in the UK and international partners, supported by Europol, also announced plans for further action against people who used the platform to make fraudulent calls.
organisation Ayoub Sehailia
The five individuals have been identified as Ayoub Sehailia, 28, Zakkaria Sehailia, 30, Usman Din, 30, Denis Ozmus, 29, and 53-year-old Fadila Salem who all hail from different parts of the capital.
The five people charged are 28-year-old Ayoub Sehailia, 30-year-old Zakkaria Sehailia, 30-year-old Usman Din, 29-year-old Denis Ozmus, and 53-year-old Fadila Salem, 53, all from London.
victims 170,000 estimated victims
" Since 2020, when it first surfaced, the platform has been linked to tens of millions in financial losses affecting an estimated 170,000 victims.
organisation EDR
The Picus whitepaper shows how breach and attack simulation tests your SIEM and EDR rules so threats stop slipping by detection.
‎August 14 2026
Five suspects were charged in connection with the "Russian Coms" fraud platform case.
organisation Westminster Magistrates’ Court
All five suspects will appear at Westminster Magistrates’ Court on August 14 2026.
organisation Telegram
Marketed through Snapchat, Instagram and Telegram, the cybercrime-as-a-service package sold to fraudsters included “unlimited minutes,” “hold music,” “encrypted phone calls,” “instant handset wipe,” international calls, voice-changing services, and 24/7 support.
organisation IP
The handset version also included several VPN apps enabling users to hide their IP address, and a burner app that instantly wiped the phone after being activated.
‎Friday, August 14
Five individuals are scheduled to appear in Westminster Magistrates' Court on August 14.
organisation Westminster Magistrates' Court
All five are scheduled to appear at Westminster Magistrates' Court on Friday, August 14.
Tactical Metrics
Metrics
financial
9,000,000
Stolen / Extorted Funds
Mor recently, Operation Henhouse 5 led to the arrest of over 500 suspects, as well as account freezing orders against £9m ($12m), and seizures of cash and assets worth £18.1m ($24.3m).
Metrics
financial
18,100,000
Stolen / Extorted Funds
Mor recently, Operation Henhouse 5 led to the arrest of over 500 suspects, as well as account freezing orders against £9m ($12m), and seizures of cash and assets worth £18.1m ($24.3m).
Metrics
financial
24,300,000
Stolen / Extorted Funds
Mor recently, Operation Henhouse 5 led to the arrest of over 500 suspects, as well as account freezing orders against £9m ($12m), and seizures of cash and assets worth £18.1m ($24.3m).
Metrics
data_breach
500,000
Unique Phone Numbers
​Until its shutdown, criminals used the platform to make over 1.3 million calls to 500,000 unique phone numbers across more than 107 countries, including the United Kingdom, the United States, New Zealand, Norway, and France, resulting in average l…
Metrics
victims
170,000
Estimated Victims
" Since 2020, when it first surfaced, the platform has been linked to tens of millions in financial losses affecting an estimated 170,000 victims.
Intelligence Sources
Infosecurity-Magazine 2026-07-14
BleepingComputer 2026-07-13