In this case, authorities identified various roles within the criminal enterprise. These included drivers who traversed the city with the specialized equipment, individuals responsible for preparing the fraudulent content and embedded links in the messages, and members dedicated to configuring the devices and managing the phishing campaigns.
The core equipment, an IMSI catcher, did not require a large fleet of vehicles. Instead, it was strategically moved from car to car and from one location to another. Similarly, no fixed operational base was needed; a car trunk sufficed to launch and execute an operation.
This mobility significantly allowed them to expand their broadcast zones and target multiple areas over successive days.
Investigators had to meticulously cross-reference technical data with on-site observations to trace the individuals involved. A crucial traffic stop proved instrumental, as it directly linked a suspect vehicle to the sophisticated equipment being used.
During the course of the proceedings, investigations revealed that these devices originated from a supplier based in China. Yin Nongzhong had reportedly sold multiple autonomous units to the teams involved in this case, each capable of operating independently once installed in a vehicle.
