Loading story…
INTERPOL, the Algerian National Police, and Group-IB dismantled SniperDZ, a phishing-as-a-service ecosystem that operated for nearly a decade and enabled large-scale credential theft, personal-data harvesting, and browser-based fraud. Investigators said the operation distributed about 80 free phishing templates through Telegram and Facebook channels, impersonated roughly 30 major online platforms, and relied on more than 20,000 domains to host fake login pages. Group-IB attributed the infrastructure to a threat actor known as Guedz after analyzing tutorial videos that exposed an administrator panel and backend email addresses; Algerian authorities then arrested the suspect and seized hardware containing phishing code and malicious scripts.
Researchers said SniperDZ also functioned as a centralized push-notification abuse platform used heavily across the Middle East and North Africa. Campaigns used fake Facebook and Instagram posts impersonating politicians, public figures, and telecom providers to lure victims with offers such as free mobile data, compensation, and subsidy programs, then redirected them through link shorteners and attacker-controlled chains to phishing pages that requested browser notification permissions. Group-IB linked multiple campaigns to the same ecosystem through a recurring VAPID public key and infrastructure hosted on Horizon IS, and documented cloaking, browser-history manipulation, and tab-under techniques used to evade detection while monetizing victims through unsolicited ads, scams, and malicious content. The takedown formed part of Operation Ramz, which spanned 13 countries and resulted in 201 arrests, 53 malicious servers seized, and 3,867 compromised endpoints and victims identified.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
5 events from the most recent confirmed update back to the earliest known activity.
In 2024, Group-IB investigated social engineering attacks targeting the MENA region and traced them to the SniperDz phishing-as-a-service platform. The investigation connected the activity to the broader ecosystem later disrupted under Operation Ramz.
Algerian authorities arrested the suspected operator Guedz and seized hardware containing phishing code and malicious scripts. The action was part of the broader dismantling of the SniperDZ phishing network involving Group-IB, INTERPOL, and the Algerian National Police.
After analyzing tutorial videos that exposed an administrator panel and backend email addresses, Group-IB attributed the SniperDZ operation to a threat actor known as Guedz. Separate research also tied multiple campaigns to the same ecosystem through a recurring VAPID public key and shared infrastructure hosted on Horizon IS.
INTERPOL's Operation Ramz was conducted across 13 countries from October 2025 to 2026-02-28. The operation resulted in 201 arrests, the seizure of 53 malicious servers, and the identification of 3,867 compromised endpoints and victims.
SniperDZ ran a long-lived phishing ecosystem that distributed around 80 free phishing templates through Telegram and Facebook channels, targeted about 30 major online platforms, and used more than 20,000 domains to host fake login pages. Group-IB also described the ecosystem as supporting large-scale brand impersonation, credential theft, and browser-notification abuse across the Middle East and North Africa.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
5 references tracked. Mallory keeps watching after this page renders.
thehackernews.com
Open sourcegroup-ib.com
Open sourcethehackernews.com
Open sourcecybersecuritynews.com
Open sourcehackread.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
**INTERPOL** said **Operation Synergia III** led to the arrest of **94 suspects**, the seizure of **212 devices and servers**, and the sinkholing or takedown of more than **45,000 malicious IP addresses** tied to cybercrime infrastructure across **72 countries and territories**. The operation ran from July 2025 through January 2026 and targeted infrastructure supporting **phishing, malware, ransomware, romance scams, credit card fraud, and related online fraud**. Authorities said **110 additional individuals remain under investigation**, underscoring that follow-on enforcement activity is still ongoing. Preliminary case details show broad international participation and a focus on both technical infrastructure and fraud operators. In **Macau**, investigators identified more than **33,000 phishing and fraudulent websites**, including fake casino, banking, government, payment, and other critical-service sites used to steal credentials and payment data. In **Bangladesh**, authorities arrested **40 suspects** and seized **134 devices** linked to loan scams, employment scams, identity theft, and credit card fraud, while in **Togo** police arrested **10 suspects** tied to a fraud ring whose members split responsibilities between account compromise and social-engineering schemes such as romance and sextortion scams. The reporting describes a coordinated law-enforcement disruption of active criminal infrastructure rather than a vendor announcement or generic security guidance.
Jun 29, 2026
INTERPOL said **Operation Ramz** led to 201 arrests across 13 Middle East and North Africa countries after a coordinated campaign against phishing, malware, and online scam networks. The operation, described as the first cybercrime action of its scale in the region, ran from October 2025 through 28 February 2026 and also identified 382 additional suspects, 3,867 victims, and 53 seized servers, with nearly 8,000 intelligence and investigative data points shared among participating authorities. Investigations produced multiple country-level disruptions, including the dismantling of a phishing-as-a-service platform in Algeria, the seizure of phishing infrastructure and banking data in Morocco, the disabling of a vulnerable malware-infected server in Oman, and the exposure of a financial fraud and fraudulent investment scheme in Jordan that also involved human trafficking victims. INTERPOL said the crackdown involved Algeria, Bahrain, Egypt, Iraq, Jordan, Lebanon, Libya, Morocco, Oman, Palestine, Qatar, Tunisia, and the United Arab Emirates, with support from private-sector partners including Group-IB, Kaspersky, Shadowserver Foundation, Team Cymru, and TrendAI.
Aug 11, 2026
U.S. and European authorities dismantled the **GozNym** cybercrime network, unsealing charges against 10 alleged members and coordinating arrests, extraditions, and prosecutions across the United States, Georgia, Ukraine, Moldova, Germany, and Bulgaria with support from **Europol** and **Eurojust**. Officials said the group operated as a cybercrime-as-a-service enterprise, combining malware development, phishing spam, crypting, bulletproof hosting, account takeover, and cash-out roles to target primarily U.S. businesses and financial institutions, while some suspects remained fugitives. Investigators said GozNym infected more than **41,000 computers** and was used in roughly **$100 million** in attempted fraud against victims in the United States and elsewhere. The malware was distributed through the **Avalanche** criminal infrastructure, a fast-flux botnet platform previously used by more than 20 malware families before its takedown, and Shadowserver said its sinkholing and victim-remediation reporting had helped protect about **2 million victim IP addresses daily** in the years following that operation.
Aug 14, 2026