The scam mastermind was based in the United Arab Emirates (UAE), officials said.

Addressing the media, Arun Kumar, RPF Director General, said, "After we launched the Operation Thunderstorm last year against ticket touts, a name -- Ghulam Mustafa -- kept appearing on our radar."

Mustafa was arrested from Bhubaneswar earlier this year, and the RPF recovered from him two laptops with software named ANMS. "By using this software, he bypassed the barriers, like providing captcha and bank OTPs (one-time password), set up to curb illegal ticketing," Kumar said.

The scamsters then converted the collected money to crypto currency and through shadow net sent that abroad, which was allegedly used in "terror funding, money laundering and others," he said. "We have identified a person named Hamid Ashraf, based in Dubai, and suspected him to be the mastermind of the racket," Kumar said.

Ashraf, the DG said, was arrested by the Central Bureau of Investigation (CBI), the Railway Vigilance and the police in 2016 from Basti in UP. But after getting bail, he escaped to Dubai via Nepal.

During Mustafa's interrogation by the NIA, the Karnataka Police and the Intelligence Bureau, it was found that he was using the Darknet to convert the money to crypto currency for laundering.

Mustafa also used 563 personal IRCTC IDs to book confirmed tickets through ANMS software and around 3,000 bank accounts.

"The decryption of his laptop revealed that he was a follower of the Pakistan-based Tableek-e-Jamaat and had many Pakistani, Bangladeshi, Middle-Eastern, Indonesian and Nepalese numbers. He also had a software to create fake Aadhaar and PAN cards," the DG said.

A number of Pakistani software and several highly encrypted messages were found in his laptop.

The RPF has also identified a software company that was receiving money from the group. The company is being investigated by the Singapore Police for money laundering.

"We have also traced a person named Guruji, believed to be the group's technical expert, who recently received Rs 13 lakh from Mustafa," Kumar said. Guruji was using Yogoslavian number of VPN to avoid the identification, he added.

"He is also suspected to be facilitating Bangladeshi nationals for treatment at several hospitals, which could be part of an organ trade operated by them," the RPF officer said.

The ANMS software, developed by them, the D-G said worked in tiers, with the main developer at the top of the chart, followed by the lead sellers or super admins who handled money and sent them to Ashraf through Hawala accounts and crypto currency. Then were panel sellers, the people who bought the software for selling tickets, and the last tier included agents, he said.

"We have arrested 27 people on the basis of Mustafa's questioning," Kumar said.