Phishing attacks through business and personal email were the primary attack route of this well-organized operation. Modern threat models should include not just nation state sponsored Advanced Persistent Threats (APT), but also financially motivated criminals that target both large and small businesses as well as individuals with personal assets or access to business infrastructures. Personal attacks can be mitigated through regular updates, use of EDR or antivirus security products, and avoiding clicking through any suspicious or unusual links. Businesses can mitigate risks in a similar fashion but also need to protect their larger infrastructures with a robust defense in depth strategy that enables comprehensive post-exploitation mitigation and detection; such a strategy can include the threat hunting and MDR offerings from Binary Defense.

https://thehackernews.com/2021/09/europol-busts-major-cybercrime-ring.html

https://www.europol.europa.eu/newsroom/news/106-arrested-in-sting-against-online-fraudsters