OVERVIEW OF 2024 ● Hannes Kelt, head of the cyber and economic crimes unit at the North Prefecture of the Estonian police, explained that his team began investigating a wave of phishing links exploiting the names of banks operating in Estonia a few years ago. “Collecting evidence and analysing the data led us to LabHost. We brought in other countries, which also launched investigations, and the result was the closure of one of the largest platforms of its kind,” Kelt said. CRIMINALS DETERRED WITH THREE SOFTWARE TOOLS The unit led by Hannes Kelt was tasked with discouraging and deterring criminals operating on the LabHost platform; the team used three software tools. The first tool was designed to neutralise all phishing websites actively used for scams. After months of information gathering and analysis, all fraudulent environments and the thousands of associated phishing sites were shut down in April 2024. Simultaneously, raids led to the arrest of dozens of crime organisers. However, the platform has been used by thousands of lower-level criminals worldwide. To target these individuals, experts from the North Prefecture developed a second programme resembling a social media or content-sharing platform. Much like year-end summaries sent by commercial platforms (“2024 Wrapped”), which show users the pictures they have shared, the posts they have made, or the music they have listened to most, 700 of the most active scammers using fraudulent platforms received a similarly detailed report from the police about their activities. At the end of the report was a recommendation to contact the police and confess their crimes as soon as possible – many did. Another 1,500 less active criminals received written summaries of their activities, reminding them that operating on fraudulent platforms does not guarantee anonymity or protection. The third tool was used within the criminals’ communication platforms. A chatbot operating CYBER SECURITY IN ESTONIA 2025 in these environments was taken over, and police information was disseminated through their chats. For example, criminals received videos and messages showing arrests and examples of evidence gathered from the platform, aiming to amplify the police’s message and demonstrate that even encrypted communication platforms do not provide complete anonymity. “This type of deterrence is particularly effective for less experienced criminals to nudge them back onto the right path early on. Overall, the operation was very successful, as even LabHost’s key figures acknowledged in the end, warning their clients themselves and advising them to go into hiding and destroy their devices,” Kelt explained. THE FIGHT CONTINUES Kelt emphasised that international operations of this scale require excellent cooperation and coordination. “Through joint efforts, we shut down a platform that enabled thousands of scammers to operate. Unfortunately, this was not the only such platform, and police efforts to stop fraudsters continue. Fraud is a global crime, and even shutting down a major platform doesn’t provide a permanent solution, as criminals remain highly motivated to develop and use new methods of fraud.” CERT-EE, the Information System Authority’s incident handling unit, identifies hundreds of phishing and scam sites every month. CERTEE blocks access to these sites, notifies web hosts and shares information with its international partners. Over recent years, tripartite cooperation with the police and banks operating in Estonia has become so effective that detected phishing sites can now be taken down in just minutes, halting data theft swiftly. ● In recognition of its contributions to the preparation of PhishOFF, the Cyber and Economic Crimes Unit at the North Prefecture of the Estonian Police and Border Guard Board received Europol’s award for the most innovative police operation in 2024. 25