Loading story…
INTERPOL said Operation Synergia III led to the arrest of 94 suspects, the seizure of 212 devices and servers, and the sinkholing or takedown of more than 45,000 malicious IP addresses tied to cybercrime infrastructure across 72 countries and territories. The operation ran from July 2025 through January 2026 and targeted infrastructure supporting phishing, malware, ransomware, romance scams, credit card fraud, and related online fraud. Authorities said 110 additional individuals remain under investigation, underscoring that follow-on enforcement activity is still ongoing.
Preliminary case details show broad international participation and a focus on both technical infrastructure and fraud operators. In Macau, investigators identified more than 33,000 phishing and fraudulent websites, including fake casino, banking, government, payment, and other critical-service sites used to steal credentials and payment data. In Bangladesh, authorities arrested 40 suspects and seized 134 devices linked to loan scams, employment scams, identity theft, and credit card fraud, while in Togo police arrested 10 suspects tied to a fraud ring whose members split responsibilities between account compromise and social-engineering schemes such as romance and sextortion scams. The reporting describes a coordinated law-enforcement disruption of active criminal infrastructure rather than a vendor announcement or generic security guidance.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
7 events from the most recent confirmed update back to the earliest known activity.
INTERPOL disclosed the results of Operation Synergia III, highlighting the scale of the multinational crackdown and the role of cross-border law enforcement and private-sector intelligence sharing.
The operation ended on 2026-01-31 after sinkholing or taking down more than 45,000 malicious IP addresses and servers, seizing 212 devices and servers, arresting 94 people, and placing 110 more under investigation.
India's Central Bureau of Investigation searched locations across four states in a transnational online investment and part-time job fraud case linked to Dubai-based fintech platform Pyypl, and identified Ashok Kumar Sharma as a key member taken into custody.
Bangladeshi authorities took major enforcement action against a cybercrime network tied to scams, identity theft, and credit card fraud, arresting 40 people and seizing 134 devices.
Authorities in Togo disrupted a fraud ring involved in hacking, romance scams, sextortion, and related fraud schemes, resulting in 10 arrests during the operation.
During Operation Synergia III, authorities in Macau, China identified over 33,000 phishing and fraud websites, including sites impersonating casinos, banks, and government platforms.
INTERPOL launched Operation Synergia III on 2025-07-18 to disrupt cybercrime infrastructure tied to phishing, malware, ransomware, and related fraud, with support from private-sector partners Group-IB, Trend Micro, and S2W.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
8 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourcehelpnetsecurity.com
Open sourcesecurityaffairs.com
Open sourcecybersecuritynews.com
Open sourcethehackernews.com
Open sourceinterpol.int
Open sourcedatabreaches.net
Open sourcego.theregister.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
INTERPOL said **Operation First Light 2026** led to **5,811 arrests** across **97 countries and territories** and the seizure or interception of **$293 million** in illicit assets during a four-month crackdown on social engineering fraud and related money laundering. The campaign, conducted between January 15 and April 30, targeted **business email compromise**, impersonation fraud, romance scams, investment scams, sextortion, and the financial networks used to move criminal proceeds. Investigators reviewed roughly **150,000 cases**, identified more than **142,000 victims**, blocked **31,014 bank accounts**, and identified **15,606 additional suspects** beyond those arrested. INTERPOL said the operation used its **I-GRIP** payment-intervention system to help stop suspicious transfers involving both fiat currency and virtual assets before settlement, with support from partners including **ASEANAPOL**, **GCCPOL**, and **Europol**. Authorities highlighted cases in **Eswatini**, **Thailand**, **Singapore and Oman**, **Macao, China**, and **Palau**, including impersonation scams, romance-scam laundering through cryptocurrency cross-chain swaps, a business email compromise investigation, and scam centres operating from hotels. The operation was funded in part by China’s Ministry of Public Security and adds to a broader series of INTERPOL-led anti-cybercrime actions such as **Synergia**, **Serengeti**, **Africa Cyber Surge**, **Red Card 2.0**, and **Synergia III**.
Jul 11, 2026
**INTERPOL’s Operation Red Card 2.0**, coordinated under the **African Joint Operation against Cybercrime (AFJOC)**, resulted in **651 arrests** across **16 African countries** and the recovery of **over $4.3 million** tied to online scam activity. The operation ran from **December 8, 2025 to January 30, 2026**, identified **1,247 victims**, and targeted criminal activity linked to **over $45 million** in losses, including **high-yield investment fraud**, **mobile money fraud**, and **fraudulent mobile loan applications**. Law enforcement reported significant disruption activity, including the seizure of **2,341 devices** and takedowns of **1,442 malicious IPs/domains/servers (and related infrastructure)**. Notable actions included Nigeria dismantling an investment-fraud ring that leveraged **phishing, identity theft, and social engineering** (with **1,000+ fraudulent social media accounts** removed) and arresting **six suspects** accused of breaching a major telecom provider using **compromised staff credentials** to steal airtime/data for resale; Kenya arrested **27 suspects** tied to social-media/messaging-driven fraud schemes; and Côte d’Ivoire arrested **58 suspects** linked to predatory loan-app activity with hidden fees and abusive collection practices.
Jun 29, 2026
INTERPOL said **Operation Ramz** led to 201 arrests across 13 Middle East and North Africa countries after a coordinated campaign against phishing, malware, and online scam networks. The operation, described as the first cybercrime action of its scale in the region, ran from October 2025 through 28 February 2026 and also identified 382 additional suspects, 3,867 victims, and 53 seized servers, with nearly 8,000 intelligence and investigative data points shared among participating authorities. Investigations produced multiple country-level disruptions, including the dismantling of a phishing-as-a-service platform in Algeria, the seizure of phishing infrastructure and banking data in Morocco, the disabling of a vulnerable malware-infected server in Oman, and the exposure of a financial fraud and fraudulent investment scheme in Jordan that also involved human trafficking victims. INTERPOL said the crackdown involved Algeria, Bahrain, Egypt, Iraq, Jordan, Lebanon, Libya, Morocco, Oman, Palestine, Qatar, Tunisia, and the United Arab Emirates, with support from private-sector partners including Group-IB, Kaspersky, Shadowserver Foundation, Team Cymru, and TrendAI.
Jun 29, 2026