In a major cybersecurity operation, Karnataka State Police's Cyber Command Unit has dismantled an illegal embedded SIM (eSIM) box network operating from two residential apartments in Bengaluru's Whitefield technology corridor. Four alleged operatives have been arrested in Tiroda, located in Maharashtra's Gondia district, after a technical investigation lasting nearly 55 days. The operation is being described as the first of its kind in India involving an eSIM box network.
The investigation focused on suspicious and unauthorised telecommunications routing identified in the Whitefield and Kadugodi areas. Unlike conventional SIM-based operations, the suspected network relied on remotely provisioned eSIM profiles, making it difficult for investigators to find the equipment, trace the connections and identify who was behind the operation.
The infrastructure was used to route telecommunications traffic through an unauthorised domestic gateway, so the international origin of calls would be hidden and the telecom services were not safeguarded, investigators said. The alleged network had also been linked to cybercrime schemes like digital arrest scams, sextortion and high-value financial fraud, police said.
How the 55-Day Cybercrime Investigation Began
According to the information, the case started after the Chief Circle Nodal Officer of Bharti Airtel Limited in Bengaluru filed a complaint on August 26, 2026. The complaint flagged suspicious and unauthorised routing activity involving Airtel connections in the Whitefield and Kadugodi areas.
Following the complaint, the Whitefield Cyber Crime Police Station started an investigation into the suspected telecommunications network. Investigators worked for nearly two months to trace the infrastructure and identify the people allegedly running it.
The virtual eSIM profiles made the investigation particularly challenging. Physical SIM cards can leave identifiable trails through retail purchases, subscriber documentation and hardware records. Digital provisioning and remote activation can make a connection harder to connect to a particular device or physical location with eSIMs.
Cyber investigators worked on digital forensics and telecommunications telemetry analysis to track the connections, it said. The investigation involved cooperating with the Department of Telecommunications (DoT), Karnataka, to track the network and locate the equipment.
Two Bengaluru Apartments Contained 320 SIM Box Slots
Investigators discovered two operational facilities in separate residential apartments in the Whitefield division. The equipment taken from the locations indicates a coordinated setup with a total of 320 SIM box slots.
The first facility, located in Kadugodi, was said to have six SIM box units with 32 slots. That was 192 slots containing provisioned eSIM connections across different telecom service providers.
The second facility, in Pattandur Agrahara, had four SIM box units with 32 slots each, providing another 128 slots. These two facilities had a total of 320 lines connected via a network of telecommunication.
A SIM box (also called a GSM gateway) can be used to make calls between different telecommunications networks. While such equipment could have legitimate applications in a system that is fully authorised, in its unauthorised use it could be used to fake telecoms, hide the origin of the call or to bypass the normal routing arrangement.
The facilities were described as “an illicit channel of exchange,” the police alleged, and that unauthorised traffic was passing through the domestic telecommunications infrastructure. The equipment and digital records will be key in determining how the network operated and who actually controlled it.
Four Suspects Arrested in Maharashtra
After tracking digital records of suspected eSIM profiles, investigators followed the trail to Tiroda in Maharashtra’s Gondia district. Police alleged that people there were involved in procuring SIM credentials and converting them into activated eSIM profiles that supplied the Bengaluru gateways remotely.
Four people, all in Tiroda, were arrested in connection with the case. Their identities have not been revealed by police, because the investigation is still ongoing.
Investigators will examine the alleged procurement and activation process, find out where the credentials were obtained and whether other individuals or locations were involved. The arrests are a stage in the investigation rather than a final determination of responsibility.
Authorities will also need to establish how the suspected network was financed, who directed its operations and whether its infrastructure was used in particular criminal cases.
Possible Links to Digital Arrest Scams and Financial Fraud
One of the most serious aspects of the investigation is the alleged use of the eSIM box network as telecommunications infrastructure for cybercrime. Police said preliminary leads suggest possible links to digital arrest scams, sextortion operations and high-value financial fraud schemes targeting people across India.
In digital arrest scams, fraudsters often impersonate law enforcement officials or government officials and threaten victims with fabricated criminal accusations. Victims are then forced to transfer money under the false notion that they need to cooperate with an investigation. Sextortion schemes can involve threats to expose private pictures or information unless a victim pays money.
An unauthorised telecom gateway could enable fraudsters to route calls across different networks, making it harder to trace the original source. But investigators must monitor call records, digital logs and evidence from individual cases to determine whether or not this particular network has been involved.
Dr. Pronab Mohanty, IPS, Director General of Police, Cyber Command, said preliminary leads indicated the possibility of substantial financial exposure, potentially running into hundreds of crores of rupees across the wider network. He also warned that the number of victims, total financial losses and the network's full reach remain to be verified.
Forensic Analysis Underway as Probe Continues
The investigation has now moved to forensic analysis of seized gateway equipment and cloud logs. The call route is to map the network and identify the infrastructure, its operators and cybercrime cases.
In a First for India, Karnataka Cyber Command Busts Illegal eSIM Box Syndicate; 4 Held After 55-Day Hunt Bengaluru In a landmark operation marking the first such case cracked anywhere in the country, the #Karnataka State Police #CyberCommand Unit has busted an illegal embedded SIM (#eSIM) box network operating clandestinely out of two residential apartments in the Whitefield tech corridor, officials confirmed on Thursday. The breakthrough came after an arduous, nearly 55-day technical pursuit. Unlike conventional physical SIM cards that leave direct point-of-sale footprints and visible hardware trails, tracking virtual eSIM profiles across encrypted networks presented severe investigative challenges. Investigators had to pierce through layered digital provisioning pipelines before finally closing in on the syndicate's infrastructure and supply chain. Four key operatives linked to the illicit procurement and conversion of eSIMs have been arrested from Tiroda in #Maharashtra’s Gondia district. The 55-Day Investigation and Bust The probe began after the Chief Circle Nodal Officer of Bharti #Airtel Limited, #Bengaluru, lodged a complaint on August 26, 2026, flagging suspicious, unauthorized routing over Airtel connections in the Whitefield and Kadugodi pockets. The #Whitefield #CyberCrime Police Station (CCPS) registered and set the technical hunt in motion. Because the syndicate deployed virtual eSIM profiles rather than traditional physical SIM cards, pinpointing the hardware locations and device identities required extensive cyber forensics and telemetry analysis in close coordination with the Department of Telecommunications (#DoT), Karnataka. Following nearly two months of sustained tracking, joint teams raided two high-density operational hubs functioning in separate apartments within the Whitefield division: 1. Kadugodi Facility: Six SIM Box (GSM gateway) units housing 32 slots each, totaling 192 slots active with provisioned eSIM connections across multiple telecom service providers. 2. Pattandur Agrahara Facility: Four SIM Box units with 32 slots each, accounting for 128 active slots. Operating in tandem, the dual facilities wielded a combined capacity of 320 live lines running through a single coordinated network. The setup functioned as an illicit domestic exchange, masking international originations and routing unauthorized traffic to bypass telecom firewalls and lawful interception systems. Tracing the digital breadcrumbs behind the virtual profiles led cyber investigators to Tiroda in Maharashtra’s Gondia district, where operatives were procuring SIM credentials and converting them into activated eSIM profiles to feed the Bengaluru gateways remotely.Four accused persons, all residents of #Tiroda, were tracked down and arrested; however, police have withheld their identities citing the ongoing investigation. According to police, the country-first eSIM box setup served as the core telecommunications backbone for widespread cyber intimidation schemes nationwide, including infamous "#DigitalArrest" scams, sextortion rackets and high-value financial fraud. "Preliminary leads suggest the possibility of substantial financial exposure, potentially running into hundreds of crores of rupees across the wider network," said Dr. Pronab Mohanty, IPS, Director General of Police, Cyber Command. "The actual number of victims, financial losses, and the full extent of the network remain subject to verification through continuing investigation and inter-agency coordination." Forensic analysis of the seized gateway hardware and cloud logs is underway to map out every call routed through the hub and uncover the masterminds directing the syndicate. @KarnatakaCops @DgpKarnataka @PriyankKharge @DoT_India @airtelindia @PIBHomeAffairs
— Yasir Mushtaq (@path2shah) October 22, 2026
The findings could help law enforcement determine whether the suspected network was in service of multiple fraud groups, identify other participants and determine the extent of the alleged financial losses. Inter-agency coordination will also be important if evidence points to victims, operators or infrastructure in other states.
The recent operation highlights the complexity of cybercrime investigations involving digital telecommunications. Realistically speaking, eSIMs are a convenience for the regular user, yet the alleged abuse of provisioning systems and telecom gateways can make enforcement and service provision more challenging.
Now, four suspects have been arrested, two Bengaluru facilities have been identified, and the seized equipment is being examined for forensic evidence. Police have not yet identified the full extent of the alleged syndicate or the final number of victims and financial losses. Further investigation will determine how extensive the network was and if more arrests follow.
Comments
Leave a Comment