Türkiye’s National Intelligence Organization (MIT) has dismantled a cyber espionage network that sought to steal personal and financial data from citizens by imitating corporate identities through fake cell towers, security sources said Saturday.
After months of investigations and surveillance, seven foreign nationals were caught red-handed in a joint operation with Istanbul police and prosecutors, sources said, adding that the suspects were arrested by an Istanbul court.
The suspects were operating three different groups within the same network and receiving their orders from another suspect code-named “Patron” (Boss).
MIT launched an investigation following numerous complains from mobile network subscribers that they were receiving fake messages seemingly sent by public institutions and corporate firms.
MIT found the messages were being sent through fake cell towers set up using devices determined to be of Chinese origin.
Mobile phones were connected to these towers and fake messages were sent to users pretending to be mobile network operators to request payments.
The suspects operated several rental vehicles containing fake cell towers in Istanbul, as well as western Izmir, Bursa and Yalova provinces, aiming to reach a vast user base, sources said.
They collected communication data and other user information, all of which was transferred to a server based in China. The suspects then used the data for phishing attacks through a foreign application.
MIT found some users made payments by sharing their credit card information with the espionage network.
Sources said the foreign nationals entered Türkiye in March 2025 and sought to conceal their identities by obtaining a GSM line using the name of a Turkish citizen.
Authorities are currently examining customs and border crossing records to determine how the suspects smuggled the devices they used into the country. The fake cell towers and other digital materials apprehended during the operation are currently under criminal evaluation.
The investigation is still underway to unearth the suspects’ connections, sources said.
Last October, Turkish authorities arrested nine people similarly linked to a global cyber espionage network, which is accused of sharing stolen personal data and other critical information with various entities, including terrorist organizations.
According to the ongoing confidential investigation, the seized data was also used by organized crime rings to blackmail citizens, including adolescents and even children.
MIT plans to continue expanding its cyber espionage operations to safeguard sensitive personal data and will scrutinize international connections as well.
Turkish intelligence, in recent years, has uncovered several spy networks operated by independent groups, terrorist organizations like Daesh, or foreign intelligence agencies in Türkiye.
Also in October, authorities in Istanbul indicted seven suspects for conducting espionage for Chinese intelligence, while in September, 37 people accused of working for Israel’s Mossad intelligence were handed prison sentences ranging from six to eight years.
According to Turkish security sources, Mossad often uses online communication applications to recruit operatives to spy on Palestinians and other foreign nationals living in Türkiye.