A wide ranging cyber fraud network operating across multiple Indian states has been exposed following the filing of a charge sheet by the Central Bureau of Investigation.
The agency has charged 17 individuals, including 4 Chinese nationals, along with 58 companies, in connection with a large transnational cyber fraud operation. The foreign handlers were identified as Zou Yi, Huan Liu, Weijian Liu, and Guanhua Wang, who allegedly directed the creation of shell companies in India from 2020 onwards.
The investigation gained momentum after the arrest of 3 key Indian accused in October 2025. According to the agency, a single organised syndicate created a sophisticated digital and financial setup to defraud thousands of citizens using misleading loan apps, fake investment schemes, Ponzi and MLM models, bogus part time job offers, and fraudulent online gaming platforms.
The case was registered based on inputs from the Indian Cybercrime Coordination Centre under the Ministry of Home Affairs. While the complaints initially appeared unrelated, the agency said a deeper analysis revealed common patterns in applications, fund flows, payment gateways, and digital footprints.
“Though initially appearing as isolated complaints, a detailed analysis by the CBI revealed striking similarities in the applications used, fund-flow patterns, payment gateways, and digital footprints, pointing towards a common organised conspiracy,” the agency said.
Cyber investigators alleged that the syndicate used Google advertisements, bulk SMS campaigns, SIM box messaging systems, cloud infrastructure, fintech platforms, and multiple mule bank accounts. “Each stage of the operation, from luring victims to the collection and movement of funds, was deliberately structured to conceal the identities of the actual controllers,” the agency added.
The probe uncovered 111 shell companies created using dummy directors and forged documents. These entities were used to route over ₹1,000 crore, with one account alone receiving more than ₹152 crore in a short period. Searches at 27 locations across several states led to the seizure of digital and financial evidence. A UPI ID linked to accused accounts was found active abroad until August 2025, confirming foreign control of operations.
Also read: Viksit Workforce for a Viksit Bharat
Do Follow: The Mainstream formerly known as CIO News LinkedIn Account | The Mainstream formerly known as CIO News Facebook | The Mainstream formerly known as CIO News Youtube | The Mainstream formerly known as CIO News Twitter
About us:
The Mainstream is a premier platform delivering the latest updates and informed perspectives across the technology business and cyber landscape. Built on research-driven, thought leadership and original intellectual property, The Mainstream also curates summits & conferences that convene decision makers to explore how technology reshapes industries and leadership. With a growing presence in India and globally across the Middle East, Africa, ASEAN, the USA, the UK and Australia, The Mainstream carries a vision to bring the latest happenings and insights to 8.2 billion people and to place technology at the centre of conversation for leaders navigating the future.
