INSPECTING ARCHIVED INTELLIGENCE (OUTDATED VERSION).

Interpol Seizes 53 Malware Phishing Servers in Operation Ramz

| 2026-05-19 07:52 LOW HIGH MALWARE & BOTNETS PHISHING & SOCIAL ENGINEERING LAW ENFORCEMENT
JSON
Executive Summary
AI-generated
Una gran operación de Interpol en Oriente Medio y el Norte de África, bautizada como Ramz, ha resultado en la detención de 201 personas e identificación de otros 382 sospechosos en una ofensiva coordinada contra infraestructuras utilizadas para fraudes online, distribución de malware y campañas de phishing. La operación se desarrolló entre octubre de 2025 y el 28 de febrero de 2026 y involucró a 13 países: Argelia, Baréin, Egipto, Irak, Jordania, Líbano, Libia, Marruecos, Omán, Palestina, Catar, Túnez y Emiratos Árabes Unidos. Las autoridades incautaron 53 servidores utilizados para actividades de phishing, malware y fraude online, identificando al menos 3.867 víctimas confirmadas a partir del análisis de casi 8.000 paquetes de inteligencia recuperados. El objetivo de la operación era investigar y desmantelar infraestructura maliciosa, identificar a los responsables y prevenir nuevas pérdidas económicas en una región cada vez más expuesta a campañas de fraude digital.
Technical Mitigations AI-generated
• Network Intrusion Prevention (ATT&CK mitigation for Phishing): Network intrusion prevention systems and systems designed to scan and remove malicious email attachments or links can be used to block activity. • Restrict Web-Based Content (ATT&CK mitigation for Phishing): Determine if certain websites or attachment types (ex: .scr, .exe, .pif, .cpl, etc.) that can be used for phishing are necessary for business operations and consider bloc
Intelligence Metadata
Actors / Malware / CVEs / Campaigns
Operation Synergia IIIOperation Synergia IIIOperation Ramz DisruptsOperation Ramz DisruptsOperation RamzOperation RamzOperation Red CardOperation Red Card
Target & Sectors
DACH DACH GCC GCC AFRICA AFRICA cryptocurrencycryptocurrency financefinance
Incident Timeline
‎2026/05/19
Threat actors were disrupted by Algerian authorities in Operation Ramz, a coordinated cybercrime crackdown that resulted in 201 arrests and the identification of an additional 382 suspects across 72 countries.
infrastructure 53 servers
In addition to the arrests, authorities seized 53 servers used for phishing, malware, and online fraud that affected at least 3,867 confirmed victims, as determined from nearly 8,000 intelligence packages retrieved from the equipment.
"In addition to the arrests made, 3,867 victims were identified, and 53 servers were seized.
victims 3,867 confirmed victims
In addition to the arrests, authorities seized 53 servers used for phishing, malware, and online fraud that affected at least 3,867 confirmed victims, as determined from nearly 8,000 intelligence packages retrieved from the equipment.
"In addition to the arrests made, 3,867 victims were identified, and 53 servers were seized.
victims 15 trafficked workers
…compromised devices unknowingly used to spread malware in Qatar dismantling an investment scam operation in Jordan, where 15 trafficked workers from Asia were forced to run fraud schemes; two organizers were arrested disabling a vulnerable malw…
infrastructure 45,000 malicious IP addresses
In March, the authorities announced ‘ Operation Synergia III ,’ which resulted in sinkholing 45,000 malicious IP addresses, the seizure of 212 devices and servers, and the arrest of 94 individuals across 72 countries, for participating in phishing,…
infrastructure 212 devices
…uthorities announced ‘ Operation Synergia III ,’ which resulted in sinkholing 45,000 malicious IP addresses, the seizure of 212 devices and servers, and the arrest of 94 individuals across 72 countries, for participating in phishing, hacking, fraud…
financial $294,820 restitution
The sentencing of David Jose Gomez Cegarra , 25, of Venezuela to time served and pay restitution totaling $294,820 in connection with a string of ATM jackpotting incidents between October 5 and November 11, 2024, in the U.S. states of New York, M…
financial $250 conspiracy
The sentencing of Marlon Ferro (aka GothFerrari), 20, of Santa Ana, California, to 78 months in prison in connection with a social engineering conspiracy that stole more than $250 million in cryptocurrency from victims across the U.S. between late…
data_breach 96 databases
The conviction of Sohaib Akhter , 34, of Alexandria, Virginia, by a federal jury for deleting 96 databases storing U.S. government information and stealing the plaintext password of an individual who had submitted a complaint to the Equal Employ…
Tactical Metrics
Metrics
victims
15
Trafficked Workers
…compromised devices unknowingly used to spread malware in Qatar dismantling an investment scam operation in Jordan, where 15 trafficked workers from Asia were forced to run fraud schemes; two organizers were arrested disabling a vulnerable malw…
Metrics
infrastructure
53
Servers
In addition to the arrests, authorities seized 53 servers used for phishing, malware, and online fraud that affected at least 3,867 confirmed victims, as determined from nearly 8,000 intelligence packages retrieved from the equipment.
"In addition to the arrests made, 3,867 victims were identified, and 53 servers were seized.
Metrics
victims
3,867
Confirmed Victims
In addition to the arrests, authorities seized 53 servers used for phishing, malware, and online fraud that affected at least 3,867 confirmed victims, as determined from nearly 8,000 intelligence packages retrieved from the equipment.
"In addition to the arrests made, 3,867 victims were identified, and 53 servers were seized.
Metrics
infrastructure
45,000
Malicious Ip Addresses
In March, the authorities announced ‘ Operation Synergia III ,’ which resulted in sinkholing 45,000 malicious IP addresses, the seizure of 212 devices and servers, and the arrest of 94 individuals across 72 countries, for participating in phishing,…
Metrics
infrastructure
212
Devices
…uthorities announced ‘ Operation Synergia III ,’ which resulted in sinkholing 45,000 malicious IP addresses, the seizure of 212 devices and servers, and the arrest of 94 individuals across 72 countries, for participating in phishing, hacking, fraud…
Metrics
financial
294,820
Restitution
The sentencing of David Jose Gomez Cegarra , 25, of Venezuela to time served and pay restitution totaling $294,820 in connection with a string of ATM jackpotting incidents between October 5 and November 11, 2024, in the U.S. states of New York, M…
Metrics
financial
250,000,000
Conspiracy
The sentencing of Marlon Ferro (aka GothFerrari), 20, of Santa Ana, California, to 78 months in prison in connection with a social engineering conspiracy that stole more than $250 million in cryptocurrency from victims across the U.S. between late…
Metrics
data_breach
96
Databases
The conviction of Sohaib Akhter , 34, of Alexandria, Virginia, by a federal jury for deleting 96 databases storing U.S. government information and stealing the plaintext password of an individual who had submitted a complaint to the Equal Employ…
Intelligence Sources
Bit Life Media 2026-05-19
BleepingComputer 2026-05-18
The Hacker News 2026-05-18