Mustafa Amir murder suspect: Armughan operated transnational cybercrime racket, says interim charge sheet

The National Cyber Crime Investigation Agency (NCCIA) has submitted an interim charge sheet against Armughan Kamran, the prime suspect in the Mustafa Amir murder case, in another case pertaining to operations of an illegal call centre and purchase of cryptocurrency.

Investigation Officer (IO) Ameer Ali Khoso filed the charge sheet before Judicial Magistrate (South) Abdul Saleem Kalhoro.

As per the charge-sheet, Armughan operated a “fraudulent international call centre from various DHA Karachi locations, engaging in spoofing, phishing, identity theft, and financial fraud.”

He and his agents impersonated officials of US institutions to collect personal and financial information from foreign victims using VoIP and VPN software, it said, adding that data was stored and processed using a custom tool (OET), and used for unauthorised transactions via platforms like Stripe and Braintree.

Proceeds were converted to cryptocurrency through digital wallets like BitGo, Binance, Paxful, Coinbase, etc. and then laundered through P2P platforms and local bank accounts opened in the names of the suspect’s servants and relatives, the charge sheet said.

It maintained that the suspect ran call centres under names like AIDA Communications and AMA Universal, and admitted using the dark web for buying data and narcotics. Agents for the illegal business were hired via fake job postings on Rozee.pk and Mustakabil Job portal, trained in scripts and paid through various non-traceable means, the charge sheet read.

It said that digital forensics revealed incriminating scripts, victim logs and financial data. Multiple laptops and mobile devices contained evidence of call spoofing and trademark fraud as further investigations confirmed illegal crypto activity, use of fake LLCs and gambling with fraudulent funds.

IO Khoso stated that servants’ statements revealed that their accounts and SIMs were used without their consent for laundering and spoofing. He said that partial data had been received from wallet providers while requests sent to the Securities And Exchange Commission of Pakistan, Pakistan Telecommunication Authority and other authorities were pending reply.

The IO stated that he had received digital forensics report of 63 laptops, which confirmed the use of spoofing software, VPNs, phishing scripts and victim data logs. He said that statements of witnesses and agents confirmed hiring through fake ads and detailed training in how to scam victims using predefined scripts.

In his confessional statement, the accused admitted to his involvement in digital fraud, crypto laundering, and purchase of narcotics through the dark web, the charge-sheet mentioned and added that bank and wallets record confirmed transactions linked to fraud and crypto purchases using email address and wallet IDs of the accused.

It said that the Punjab Forensic Science Agency report confirmed WhatsApp chats and use of VPN software relevant to the scam operation as servants stated that their accounts and SIMs were misused by the suspect to route fraud proceeds and conduct transactions.

The challan revealed that Armughan maintained digital wallet accounts, including Bitgo, Binance, Paxful, NoOnes, Coinbase and Exodus. These wallets were allegedly used for the purchase of cryptocurrency through funds obtained illegally from the call centre fraud victims. The accused disclosed that he used BitGo platform to purchase narcotics (weed) from the dark web.

Upon analysis of the records retrieved from BitGo, it was found that an account labelled Aida Communications was active and reflected both balances and transactional activity. The accused used Paxful to sell and purchase cryptocurrency while operating the call centre, adding that analysis of the record revealed that an account labelled ‘coinfactorypk’ was active and linked with Armughan’s email and phone number.

Binance and Coinbase record was still awaited.

“The investigation conclusively links accused Armughan Kamran, masterminded and operated a transnational cybercrime racket involving in financial fraud, data theft, electronic forgery, unauthorized fund transfers, digital identity misuse, crypto laundering, and international scamming,” the charge-sheet concluded.

“Strong evidence, including forensic data, confessional statements, and transaction trails, substantiates charges of financial crimes under national cyber laws and the Penal Code. His use of digital wallets, dark web transactions, and identity misuse show premeditated and systemic fraud.”

The IO said that further investigation was underway to identify co-conspirators and recover digital assets, adding that some more documentary, oral and digital evidence was yet to be collected. He, therefore, requested the court to accept the interim charge-sheet and grant time for submission of the final investigation report.