Spain Shuts Down GXC Team: Crime-as-a-Service Powerhouse Busted in 2025
Executive Summary
In May 2025, Spanish authorities dismantled the "GXC Team" cybercrime syndicate, arresting its alleged leader, a 25-year-old Brazilian known as "GoogleXcoder." Operating as a Crime-as-a-Service (CaaS) provider, the group developed and sold AI-powered phishing kits, multiple Android malware strains, and social engineering voice-scam tools, primarily via Telegram and Russian-speaking hacker forums. Their phishing operations targeted financial, transport, and e-commerce institutions in Spain, Slovakia, the UK, the US, and Brazil, facilitating large-scale credential theft through more than 250 spoofed sites. Law enforcement recovered stolen cryptocurrency, seized electronic evidence, and shut down illicit channels. The investigation, enabled by forensic analysis of devices and crypto transactions, remains ongoing, with further arrests anticipated.
This incident highlights the rise of CaaS platforms using automation, AI, and malware-as-a-service approaches to accelerate phishing and fraud at scale. The GXC Team case underscores the evolving sophistication and reach of these criminal ventures, which now target numerous sectors globally and leverage encrypted communications to obfuscate operations.
Why This Matters Now
The takedown of GXC Team illustrates the urgent threat posed by Crime-as-a-Service models that empower less-skilled actors to launch impactful, multi-vector cyberattacks. As authorities race to keep pace, organizations must bolster defenses against scalable, AI-driven phishing campaigns that can easily bypass legacy controls.
Attack Path Analysis
The GXC Team launched broad phishing campaigns using AI-powered phishing kits and social engineering to compromise victims’ credentials. Once inside, adversaries leveraged captured credentials and potentially malware-installed persistence to escalate privileges, enabling further access. Lateral movement was performed via cross-account or intra-cloud traversal, likely targeting sensitive banking or e-commerce infrastructure. Command & Control was established using custom malware or remote tools communicating back to GXC Team-operated infrastructure over encrypted or covert channels. Exfiltration of credentials, SMS/OTPs, and financial information ensued, utilizing stealthy egress routes. The impact included large-scale theft of credentials, financial loss to individuals and businesses, and distribution of malware to facilitate ongoing attacks.
Kill Chain Progression
Initial Compromise
Description
Attackers used phishing kits and Android malware, distributed via Telegram and fake websites, to trick users into revealing credentials or installing malicious applications.
Related CVEs
CVE-2024-25710
CVSS 7.5A vulnerability in Apache Commons Compress versions 1.3 to 1.25.0 allows attackers to cause a denial of service by triggering a crash in the web server.
Affected Products:
Apache Commons Compress – 1.3 to 1.25.0
Exploit Status:
no public exploit
MITRE ATT&CK® Techniques
Phishing: Spearphishing Attachment
Phishing: Spearphishing Link
Credentials from Password Stores
Access Sensitive Data or Credentials in Files (Mobile)
Application Layer Protocol: Web Protocols
Establish Accounts: Web Services
Establish Accounts: Social Media Accounts
Exfiltration Over C2 Channel
Potential Compliance Exposure
Mapping incident impact across multiple compliance frameworks.
PCI DSS 4.0 – Multi-factor Authentication for All Access
Control ID: 8.3.1
NYDFS 23 NYCRR 500 – Cybersecurity Policy
Control ID: 500.03
DORA (Regulation (EU) 2022/2554) – ICT Risk Management Framework
Control ID: Article 9
CISA Zero Trust Maturity Model 2.0 – Enforce Strong Authentication across Users and Devices
Control ID: Identity Pillar: Authentication
NIS2 Directive – Cybersecurity Risk-management Measures
Control ID: Article 21
ISO/IEC 27001:2022 – Responsibilities and Procedures for Information Security Incidents
Control ID: A.16.1.1
Sector Implications
Industry-specific impact of the vulnerabilities, including operational, regulatory, and cloud security risks.
Banking/Mortgage
Crime-as-a-Service phishing kits specifically targeted banking institutions, with AI-powered tools enabling credential theft and fraudulent transaction validation through intercepted SMS/OTPs.
Transportation
Transport entities faced targeted phishing campaigns from GXC Team's CaaS platform, requiring enhanced egress security and threat detection capabilities to prevent credential compromise.
Internet
E-commerce platforms suffered from sophisticated phishing kit replication and Android malware deployment, necessitating zero trust segmentation and multicloud visibility controls for protection.
Financial Services
Financial institutions experienced coordinated attacks through replicated websites and OTP interception, highlighting critical need for encrypted traffic protection and anomaly detection systems.
Sources
- Spain dismantles “GXC Team” cybercrime syndicate, arrests leaderhttps://www.bleepingcomputer.com/news/security/spain-dismantles-gxc-team-cybercrime-syndicate-arrests-leader/Verified
- Group-IB Intelligence Powers Spanish Guardia Civil Operation to Dismantle the “GXC Team” Cybercrime Syndicatehttps://www.group-ib.com/media-center/press-releases/guardia-civil-gxc-team-takedown/Verified
- Spain Arrests Alleged Leader of GXC Team Cybercrime Networkhttps://www.infosecurity-magazine.com/news/spain-arrests-leader-gxc-team/Verified
Frequently Asked Questions
Cloud Native Security Fabric Mitigations and ControlsCNSF
Applying CNSF and zero trust controls including segmentation, egress filtering, encryption, and deep visibility could have blocked critical attack phases such as lateral movement, data exfiltration, and command/control. Enforcing least privilege, network isolation, and policy-based enforcement would have restricted adversary access and limited blast radius.
Control: Threat Detection & Anomaly Response
Mitigation: Rapid detection of phishing and anomalous traffic to suspicious infrastructure.
Control: Zero Trust Segmentation
Mitigation: Lateral privilege abuse is constrained to least-privilege zones.
Control: East-West Traffic Security
Mitigation: Lateral traversal is detected and policy-blocked within the internal network.
Control: Cloud Native Security Fabric (CNSF)
Mitigation: Inline inspection and distributed policy block known C2 patterns and encrypted abuse.
Control: Egress Security & Policy Enforcement
Mitigation: Outbound exfiltration is detected and blocked at the network edge.
Security teams gain real-time cross-cloud awareness, hastening containment and limiting impact.
Impact at a Glance
Affected Business Functions
- Online Banking
- E-commerce Transactions
- Transportation Booking Systems
Estimated downtime: 3 days
Estimated loss: $5,000,000
Potential exposure of customer credentials, including usernames, passwords, and one-time passwords (OTPs), leading to unauthorized account access and fraudulent transactions.
Recommended Actions
Key Takeaways & Next Steps
- • Implement identity-based Zero Trust segmentation to robustly isolate and contain credential or device compromise incidents.
- • Deploy east-west workload traffic controls and microsegmentation to prevent lateral movement between cloud resources.
- • Enforce strict egress security and URL/FQDN filtering to block command-and-control and exfiltration channels.
- • Use real-time threat detection and anomaly response tools to quickly identify phishing campaigns and malicious traffic patterns.
- • Maintain unified, multicloud visibility for rapid investigation, incident response, and audit of security policy violations.
