The gang leader, a 27-year-old Russian, was taken into custody while on holiday in Dubai on an international arrest warrant, The Guardian reported Wednesday.
Spanish police arrested the rest -- six Russians, two Ukrainians and two Georgians -- in the Costa del Sol in southern Spain, the British newspaper said.
The gang's "ransomware" virus would freeze Windows PCs and then display messages on the screen claiming to be from police authorities and saying the user had been fined 100 euros ($130) for accessing file sharing, child pornography or terrorist sites.
Europol director Rob Wainwright said an estimated "hundreds of thousands" of Europeans had been targeted by the scam.
"If we take into account that the average fine was 100 euros ($130) and 3 percent ... paid it, then the estimated damage is millions of euros," he said.
The malware first surfaced in Russia in 2005, but had been refined by the cybercriminals to display appropriate logos for the police in the country where the user's PC was located, authorities said.