Loading story…
INTERPOL said Operation Lyrebird led to the identification and arrest in Morocco of a suspected cybercriminal known as Dr HeX after a two-year investigation supported by Group-IB. Moroccan authorities apprehended the suspect following coordination between INTERPOL’s Cybercrime Directorate and the INTERPOL National Central Bureau in Rabat, and the individual remains under investigation.
Group-IB said its inquiry began with a phishing kit impersonating a major French bank, which yielded an email address and nickname that investigators used to connect the suspect to a wider malicious infrastructure. The company linked the actor, described as active since at least 2009, to phishing, website defacements, malware development, fraud, carding, attacks on French telecommunications firms, major banks, and multinational companies, as well as more than 130 website defacements and underground forum activity involving malware trading.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
5 events from the most recent confirmed update back to the earliest known activity.
In May, Moroccan police arrested the Moroccan suspect known as Dr HeX based on cybercrime intelligence provided by Group-IB during INTERPOL's Operation Lyrebird. INTERPOL's Cybercrime Directorate coordinated with Moroccan authorities through the National Central Bureau in Rabat.
Group-IB attributed over 130 website defacements to Dr HeX over the period from 2009 to 2018. This historical activity formed part of the broader attribution case against the suspect.
Group-IB assessed that the suspect it dubbed Dr HeX had been active since at least 2009, engaging in phishing, fraud, carding, malware development, and other cybercrime. The company also linked the actor to a long-running pattern of malicious activity affecting thousands of victims.
Group-IB said its investigation attributed phishing, malware, and intrusion activity by Dr HeX to a French corporation, French telecommunications companies, major French banks, and several multinational corporations. It also said the suspect attempted to steal banking card data from the French corporation.
Group-IB said its investigation began after analysts extracted a phishing kit impersonating a large French bank and used artifacts in the kit to trace the actor's infrastructure and online identities. The investigation ultimately identified multiple email addresses, nicknames, and social media or communication accounts tied to the suspect.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
group-ib.com
Open sourcetherecord.media
Open sourceinterpol.int
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
INTERPOL said **Operation Ramz** led to 201 arrests across 13 Middle East and North Africa countries after a coordinated campaign against phishing, malware, and online scam networks. The operation, described as the first cybercrime action of its scale in the region, ran from October 2025 through 28 February 2026 and also identified 382 additional suspects, 3,867 victims, and 53 seized servers, with nearly 8,000 intelligence and investigative data points shared among participating authorities. Investigations produced multiple country-level disruptions, including the dismantling of a phishing-as-a-service platform in Algeria, the seizure of phishing infrastructure and banking data in Morocco, the disabling of a vulnerable malware-infected server in Oman, and the exposure of a financial fraud and fraudulent investment scheme in Jordan that also involved human trafficking victims. INTERPOL said the crackdown involved Algeria, Bahrain, Egypt, Iraq, Jordan, Lebanon, Libya, Morocco, Oman, Palestine, Qatar, Tunisia, and the United Arab Emirates, with support from private-sector partners including Group-IB, Kaspersky, Shadowserver Foundation, Team Cymru, and TrendAI.
Aug 11, 2026
**INTERPOL** said **Operation Synergia III** led to the arrest of **94 suspects**, the seizure of **212 devices and servers**, and the sinkholing or takedown of more than **45,000 malicious IP addresses** tied to cybercrime infrastructure across **72 countries and territories**. The operation ran from July 2025 through January 2026 and targeted infrastructure supporting **phishing, malware, ransomware, romance scams, credit card fraud, and related online fraud**. Authorities said **110 additional individuals remain under investigation**, underscoring that follow-on enforcement activity is still ongoing. Preliminary case details show broad international participation and a focus on both technical infrastructure and fraud operators. In **Macau**, investigators identified more than **33,000 phishing and fraudulent websites**, including fake casino, banking, government, payment, and other critical-service sites used to steal credentials and payment data. In **Bangladesh**, authorities arrested **40 suspects** and seized **134 devices** linked to loan scams, employment scams, identity theft, and credit card fraud, while in **Togo** police arrested **10 suspects** tied to a fraud ring whose members split responsibilities between account compromise and social-engineering schemes such as romance and sextortion scams. The reporting describes a coordinated law-enforcement disruption of active criminal infrastructure rather than a vendor announcement or generic security guidance.
Jun 29, 2026
French authorities arrested a 20-year-old suspect known online as **HexDex** in western France over a broad hacking campaign that prosecutors say is tied to about 100 breach reports filed since late 2025. Investigators said the suspect admitted using the HexDex alias to claim responsibility for intrusions and to publish or repost stolen data on **BreachForum** and **Darkforum**. Police also seized the suspect’s Darkforum account and computer equipment, while forensic analysis and the wider investigation continue. The alleged victims span public institutions, sports federations, and private organizations across France, including multiple national sports bodies, **Logis Hôtels**, **Brit Hotel**, the **Philharmonie de Paris**, food banks, the **Moselle prefecture**, and **e-campus**, a training platform used by the national police. Prosecutors also linked the case to the French Ministry of National Education’s **Compas** database, where a March breach exposed personal data belonging to about **243,000 employees**, and said the suspect is also under scrutiny over a breach involving a government firearms information system. Authorities said a separate cyberattack on **France Titres** detected on April 15 is not currently being attributed to the suspect.
Jun 29, 2026