Loading story…
Interpol coordinated a five-month international operation, codenamed HAECHI VI, targeting cyber-enabled financial crimes such as investment fraud, business email compromise, romance scams, and money laundering. Law enforcement agencies from over 40 countries seized more than $439 million in cash and cryptocurrency, blocked 68,000 bank accounts, and froze 400 cryptocurrency wallets. The operation resulted in significant arrests, including 45 suspects in Portugal involved in diverting social security funds and the seizure of $6.6 million in Thailand from a business email compromise scam targeting a Japanese corporation. The crackdown demonstrates the effectiveness of global cooperation in disrupting transnational cybercrime syndicates and recovering illicit proceeds.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
Interpol announced that Operation HAECHI VI had resulted in the seizure or recovery of about $439 million stolen by cybercrime rings worldwide. The operation also involved arrests and other enforcement measures tied to online fraud and financial crime investigations across participating jurisdictions.
Interpol coordinated Operation HAECHI VI, a global anti-fraud and cybercrime crackdown targeting criminal rings involved in cyber-enabled financial and fraud schemes across multiple countries. The operation brought together international law enforcement to identify suspects, disrupt networks, and trace illicit proceeds.
4 references tracked. Mallory keeps watching after this page renders.
helpnetsecurity.com
Open sourcesecurityaffairs.com
Open sourcebleepingcomputer.com
Open sourcetherecord.media
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
INTERPOL said **Operation First Light 2026** led to **5,811 arrests** across **97 countries and territories** and the seizure or interception of **$293 million** in illicit assets during a four-month crackdown on social engineering fraud and related money laundering. The campaign, conducted between January 15 and April 30, targeted **business email compromise**, impersonation fraud, romance scams, investment scams, sextortion, and the financial networks used to move criminal proceeds. Investigators reviewed roughly **150,000 cases**, identified more than **142,000 victims**, blocked **31,014 bank accounts**, and identified **15,606 additional suspects** beyond those arrested. INTERPOL said the operation used its **I-GRIP** payment-intervention system to help stop suspicious transfers involving both fiat currency and virtual assets before settlement, with support from partners including **ASEANAPOL**, **GCCPOL**, and **Europol**. Authorities highlighted cases in **Eswatini**, **Thailand**, **Singapore and Oman**, **Macao, China**, and **Palau**, including impersonation scams, romance-scam laundering through cryptocurrency cross-chain swaps, a business email compromise investigation, and scam centres operating from hotels. The operation was funded in part by China’s Ministry of Public Security and adds to a broader series of INTERPOL-led anti-cybercrime actions such as **Synergia**, **Serengeti**, **Africa Cyber Surge**, **Red Card 2.0**, and **Synergia III**.
Aug 11, 2026
Law enforcement agencies across multiple countries have conducted significant operations targeting cybercriminal groups responsible for large-scale financial fraud, data breaches, and cryptocurrency theft. In Spain, police arrested a 19-year-old hacker accused of stealing and attempting to sell 64 million personal data records from nine companies, while Ukrainian authorities apprehended a separate data broker who used custom malware to compromise accounts and sell access on hacker forums. In California, a member of the so-called "Social Engineering Enterprise" pleaded guilty to laundering millions in cryptocurrency stolen through sophisticated social engineering attacks, with the group responsible for a $263 million heist and extravagant spending of the proceeds. Meanwhile, Russian police dismantled a gang that used NFCGate-based malware to steal millions from bank customers by tricking victims into installing fake banking apps and harvesting card credentials for remote theft. A major international operation led by Europol and Eurojust dismantled a €700 million cryptocurrency scam network in Europe that used deepfake videos and aggressive marketing to lure victims into fake investment schemes. The network operated numerous fraudulent platforms, laundered funds through complex channels, and was taken down in coordinated raids across several countries, resulting in arrests and the seizure of cash, cryptocurrencies, and luxury items. These actions highlight the growing sophistication of cyber-enabled financial crime and the increasing collaboration between law enforcement agencies to disrupt such operations on a global scale.
Jun 29, 2026
Law enforcement agencies worldwide have intensified efforts to disrupt cybercrime networks, targeting both large-scale organized groups and individual offenders. In 2025, major international operations led to the seizure of approximately $15 billion in Bitcoin from the Prince Group, a syndicate accused of running forced-labor scam centers and crypto fraud schemes. Authorities in Southeast Asia and Africa conducted coordinated raids, arresting thousands of suspects, dismantling malicious infrastructure, and recovering millions in illicit funds. These actions were supported by intelligence sharing and technical assistance from private companies, reflecting a growing trend of cross-border collaboration to combat cyber threats such as ransomware, business email compromise, and online scams. In South Korea, police arrested four individuals accused of compromising over 120,000 IP cameras, with the intent to create and sell sexually exploitative videos. The suspects exploited weak or default passwords to gain access to cameras in sensitive locations, including medical offices. Law enforcement responded by notifying affected owners and emphasizing the seriousness of such privacy violations. These arrests are part of a broader global crackdown on cybercrime, which also included operations in Australia and the UK targeting Wi-Fi-based attacks and dark web marketplaces. Authorities continue to stress the importance of active investigation and international cooperation to address the evolving landscape of cyber-enabled crime.
Jun 29, 2026