Skip to content

FBI Unveils 'The Manipulaters', Seizes Servers in Global Cybercrime Crackdown

The Manipulaters' identity is revealed after years of operation. Global law enforcement teams seize servers and assets, aiming to disrupt their ongoing activity.

In this image, we can see an advertisement contains robots and some text.
In this image, we can see an advertisement contains robots and some text.

FBI Unveils 'The Manipulaters', Seizes Servers in Global Cybercrime Crackdown

The U.S. Department of Justice has revealed the identity of a notorious cybercrime group, known to the public as 'The Manipulaters'. The group, operating under the pseudonym 'Saim Raza', has been exposed for its lack of customer data protection, leading to a significant leak of user information and credentials.

KrebsOnSecurity first brought The Manipulaters to light in 2015, due to their brazen advertising on cybercrime forums. The core product of this group, Heartsender, is a spam delivery service that targets various internet companies. The main clients of this service are organized crime groups, who use it for business email compromise schemes.

In a significant blow to the group's operations, the FBI and Dutch authorities have seized dozens of servers and domains. These servers were found to be hosting a spam and malware service, operating from Pakistan. This seizure, along with two previous stories about the group since 2015, suggests a pattern of persistent criminal activity.

Interpol's global operation between April and August 2025 targeted various cybercrime groups, including The Manipulaters. This resulted in the seizure of over 400 million USD in assets across 40 countries, including Pakistan. A total of 39 servers and domains abroad were seized, containing millions of victim records worldwide. This action aims to disrupt the group's ongoing activity and prevent the further proliferation of these tools.

The Manipulaters, operating under the alias 'Saim Raza', have been exposed for their data protection failures and spam delivery services. Authorities have seized servers and domains, and global operations have targeted their activities. Despite these setbacks, there are no specific updates on investigations against the group, indicating that their operations may still pose a threat.

Read also:

Latest