The Civil Police of Rio Grande do Sul, through the Division for the Suppression of Electronic Property Crimes (DRCPE/DERCC), launched Operation Krypteia on the morning of Wednesday (05/07/25), aiming to dismantle a criminal organization specialized in fraud, document forgery, unauthorized access to computer devices, vehicle tampering, and money laundering. The group used data from compromised GOV.BR portal accounts to carry out the scams.
The operation mobilized approximately 120 civil police officers to execute 22 preventive arrest warrants and 25 search and seizure warrants across several cities in Rio Grande do Sul (Porto Alegre, Viamão, Alvorada, Charqueadas, Arroio dos Ratos), Santa Catarina (Florianópolis, São José, Palhoça, Criciúma), and Rio de Janeiro. The operation was supported by the Civil Police of Rio de Janeiro and Santa Catarina, the Rio Grande do Sul Penitentiary Police, and other specialized agencies.
According to detective João Vitor Heredia of the DRCPE, the operation aims to disrupt the organization from its leadership down to the members of its operational cells. So far, 17 people have been arrested, and mobile phones, documents, a firearm, and ammunition have been seized. The investigation began following a report in Gravataí, where a victim purchased a vehicle advertised online and, after making payment, discovered that the car had been stolen and the transfer document (ATPV-e) was forged.
Investigations revealed that the group's leader — already serving a sentence of over 70 years in a Rio Grande do Sul penitentiary — was directing the acquisition of stolen or burglarized vehicles in RS and SC. These vehicles were then tampered with by another cell. Subsequently, a 24-year-old technology student residing in Rio de Janeiro used social engineering to access the GOV.BR accounts of the original vehicle owners, gaining access to their vehicle documentation.
With the cloned vehicle and access to the documents, the criminals would advertise the sale of the vehicle on online marketplaces at below-market prices, attracting buyers who would ultimately complete the purchase. At that point, using fraudulent access to the GOV.BR app, one of the criminals would transfer the original vehicle's documentation to the victim. The victim, holding both the car and its paperwork, would only discover the vehicle was stolen when seeking a DETRAN inspection. By then, the funds had already been funneled through the group's financial cell in Santa Catarina, which used shell companies to launder and conceal the criminal proceeds, distributing the profits to the other members of the organization.
This was the first major operation by the State Department for the Suppression of Cybercrime of the Civil Police, created by Decree No. 58.095, published on 04/08/2025, which introduced changes to the organizational structure of the Civil Police.
This post was summarized from its original version with the use of AI, with human review.