INSPECTING ARCHIVED INTELLIGENCE (OUTDATED VERSION).

Lazarus Group Disrupts SniperDz Phishing Network

| 2026-06-11 16:18 MEDIUM HIGH PHISHING & SOCIAL ENGINEERING STATE-SPONSORED & ESPIONAGE
JSON
Executive Summary
AI-generated
The threat actor behind the Sniper Dz phishing platform has been dismantled through an INTERPOL-led operation, resulting in the disruption of a decade-long service that offered ready-made phishing kits and operational support to cybercriminals. Authorities seized hardware containing phishing software and scripts, targeting 30 major global organizations including PayPal, Facebook, Instagram, Yahoo, Netflix, and Steam. The platform leveraged social engineering techniques to exploit public figures' credibility across the Middle East and North Africa, making it a sophisticated criminal operation that exploited vulnerabilities in technology, social media, and streaming platforms.
Technical Mitigations AI-generated
* Implement robust security measures, such as encryption and secure authentication protocols, to protect user data and prevent phishing attacks. * Regularly update software and systems to patch vulnerabilities and address known exploits, reducing the risk of exploitation by cybercriminals. * Conduct thorough network monitoring and intrusion detection system (IDS) scans to identify potential threats and alert administrators promptly. * Utilize secure communication channels, such as end-to-end encrypted messaging apps or email services, for sensitive communications with users and partners.
Technical Observables Login Required
Indicators of Compromise (IoCs) Protected

Raw threat telemetry, malicious IP addresses, file hashes, and direct VirusTotal correlation are restricted to authenticated users.

Sign In to View 1 IoCs Create Free Account
ha•••••.com
Intelligence Metadata
Actors / Malware / CVEs / Campaigns
Operation Takes DownOperation Takes DownOperation RamzOperation Ramz
Target & Sectors
AFRICA AFRICA MENA MENA mediamedia
Incident Timeline
‎at least 2015
Threat actors used INTERPOL's cybercrime division to disrupt SniperDz, a global PhaaS platform.
tactic Phishing
SniperDz: A Global Phishing-as-a-Service Platform SniperDz is a PhaaS platform that has been running since at least 2015.
tactic T1566 - Phishing
SniperDz: A Global Phishing-as-a-Service Platform SniperDz is a PhaaS platform that has been running since at least 2015.
‎between October 2025
Threat actors used INTERPOL to target SniperDz in a raid that was part of Operation Ramz, which ran between October 2025 and February 2026.
campaign Operation Ramz
This raid was part of a broader threat mitigation initiative called Operation Ramz that ran between October 2025 and 28 February 2026.
The effort, codenamed Operation Ramz , took place between October 2025 and February 2026, and saw authorities from 13 countries in the Middle East and North Africa (MENA) region making 201 arrests.
general_metric 13 nations
The effort, codenamed Operation Ramz , took place between October 2025 and February 2026, and saw authorities from 13 countries in the Middle East and North Africa (MENA) region making 201 arrests.
general_metric 201 arrests
The effort, codenamed Operation Ramz , took place between October 2025 and February 2026, and saw authorities from 13 countries in the Middle East and North Africa (MENA) region making 201 arrests.
target_region MENA
The effort, codenamed Operation Ramz , took place between October 2025 and February 2026, and saw authorities from 13 countries in the Middle East and North Africa (MENA) region making 201 arrests.
source_region AFRICA
The effort, codenamed Operation Ramz , took place between October 2025 and February 2026, and saw authorities from 13 countries in the Middle East and North Africa (MENA) region making 201 arrests.
‎October 2025
Threat actors used INTERPOL's database to identify and target individuals associated with the SniperDz phishing network.
campaign Operation Ramz
The crackdown, dubbed Operation Ramz , ran from October 2025 to February 2026 across 13 countries in the Middle East and North Africa (MENA) region.
general_metric 13 nations
The crackdown, dubbed Operation Ramz , ran from October 2025 to February 2026 across 13 countries in the Middle East and North Africa (MENA) region.
target_region MENA
The crackdown, dubbed Operation Ramz , ran from October 2025 to February 2026 across 13 countries in the Middle East and North Africa (MENA) region.
target_region AFRICA
The crackdown, dubbed Operation Ramz , ran from October 2025 to February 2026 across 13 countries in the Middle East and North Africa (MENA) region.
‎28 February 2026
Threat actors used INTERPOL's database to target SniperDz in a raid that disrupted their phishing network.
campaign Operation Ramz
This raid was part of a broader threat mitigation initiative called Operation Ramz that ran between October 2025 and 28 February 2026.
‎February 2026
Threat actors used INTERPOL to disrupt the SniperDz phishing network.
attribution Operation Ramz
The effort, codenamed Operation Ramz , took place between October 2025 and February 2026, and saw authorities from 13 countries in the Middle East and North Africa (MENA) region making 201 arrests.
The crackdown, dubbed Operation Ramz , ran from October 2025 to February 2026 across 13 countries in the Middle East and North Africa (MENA) region.
general_metric 13 nations
The effort, codenamed Operation Ramz , took place between October 2025 and February 2026, and saw authorities from 13 countries in the Middle East and North Africa (MENA) region making 201 arrests.
The crackdown, dubbed Operation Ramz , ran from October 2025 to February 2026 across 13 countries in the Middle East and North Africa (MENA) region.
general_metric 201 arrests
The effort, codenamed Operation Ramz , took place between October 2025 and February 2026, and saw authorities from 13 countries in the Middle East and North Africa (MENA) region making 201 arrests.
target_region MENA
The effort, codenamed Operation Ramz , took place between October 2025 and February 2026, and saw authorities from 13 countries in the Middle East and North Africa (MENA) region making 201 arrests.
The crackdown, dubbed Operation Ramz , ran from October 2025 to February 2026 across 13 countries in the Middle East and North Africa (MENA) region.
source_region AFRICA
The effort, codenamed Operation Ramz , took place between October 2025 and February 2026, and saw authorities from 13 countries in the Middle East and North Africa (MENA) region making 201 arrests.
The crackdown, dubbed Operation Ramz , ran from October 2025 to February 2026 across 13 countries in the Middle East and North Africa (MENA) region.
‎2026/05/13
Ravie Lakshmanan and Group-IB worked with INTERPOL to disrupt Sniper Dz, a phishing-as-a-service platform.
tactic Phishing
 Ravie Lakshmanan  Jun 12, 2026 Cybercrime / Phishing An INTERPOL-led operation last month resulted in the disruption of Sniper Dz , a decade-long phishing-as-a-service (PhaaS) platform, Group-IB said Thursday.
tactic T1566 - Phishing
 Ravie Lakshmanan  Jun 12, 2026 Cybercrime / Phishing An INTERPOL-led operation last month resulted in the disruption of Sniper Dz , a decade-long phishing-as-a-service (PhaaS) platform, Group-IB said Thursday.
organisation INTERPOL
 Ravie Lakshmanan  Jun 12, 2026 Cybercrime / Phishing An INTERPOL-led operation last month resulted in the disruption of Sniper Dz , a decade-long phishing-as-a-service (PhaaS) platform, Group-IB said Thursday.
organisation Group-IB
 Ravie Lakshmanan  Jun 12, 2026 Cybercrime / Phishing An INTERPOL-led operation last month resulted in the disruption of Sniper Dz , a decade-long phishing-as-a-service (PhaaS) platform, Group-IB said Thursday.
general_metric 12  Jun
 Ravie Lakshmanan  Jun 12, 2026 Cybercrime / Phishing An INTERPOL-led operation last month resulted in the disruption of Sniper Dz , a decade-long phishing-as-a-service (PhaaS) platform, Group-IB said Thursday.
‎18 May
On 18 May, INTERPOL released its results in a press statement regarding the disruption of the SniperDz phishing network.
‎2026/06/11
Phishing actors used INTERPOL's cybercrime platform to target and disrupt the SniperDz phishing network.
tactic Phishing
Today, the cybercrime platform has a global reach and has sophisticated offerings, including ready-made phishing kits, infrastructure hosting and operational support to cybercriminals.
‎June 11
Algeria's government arrested the primary developer of SniperDz, a notorious phisher.
source_region Algeria
On June 11, Group-IB, one Interpol’s main partners for this effort, revealed that the operation led to the takedown of SniperDz and the arrest of its primary developer in Algeria.
‎between 2023 and 2024 alone
Palo Alto Networks' Unit 42 discovered over 140,000 phishing pages associated with SniperDz between 2023 and 2024.
tactic Phishing
In 2024 , Palo Alto Networks’ Unit 42 said it had discovered over 140,000 phishing pages associated with SniperDz between 2023 and 2024 alone.
organisation Palo Alto Networks’ Unit
In 2024 , Palo Alto Networks’ Unit 42 said it had discovered over 140,000 phishing pages associated with SniperDz between 2023 and 2024 alone.
‎2026/06/11
SniperDz was taken down by INTERPOL Operation Ramz.
organisation Operation Ramz
According to INTERPOL’s press release , Operation Ramz covered 13 nations, including Egypt, Morocco, Jordan, and Qatar, leading to 201 arrests and the seizure of 53 malicious servers.
As part of Operation Ramz, the website used to offer PhaaS capabilities to other cybercriminals was taken down.
infrastructure 53 malicious servers
According to INTERPOL’s press release , Operation Ramz covered 13 nations, including Egypt, Morocco, Jordan, and Qatar, leading to 201 arrests and the seizure of 53 malicious servers.
The results, announced by Interpol at the end of May , included 201 arrests, 53 servers seized and 382 suspects and 3867 victims identified.
organisation Hackread.com
Decade-Long SniperDz Phishing Network on Telegram (Image credit: Hackread.com) About Operation Ramz
victims 3867 victims
The results, announced by Interpol at the end of May , included 201 arrests, 53 servers seized and 382 suspects and 3867 victims identified.
victims 15 forced workers
During the mitigation process in Jordan, investigators tracked an investment scam platform run by 15 forced workers.
organisation Telegram
Operating via Telegram and Facebook channels, SniperDz allowed anyone, even novice hackers, to use its toolkit of 80 ready-made phishing templates for free to create fake login pages and trick people into giving away their login credentials (usernames – passwords) and other personal data.
organisation PayPal
The phishing platform allowed scammers to target users on around 30 popular platforms, including PayPal, Facebook, Instagram, Netflix, and Steam, via more than 20,000 domains.
The toolkit primarily targeted 30 major global organizations, including PayPal, Facebook, Instagram, Yahoo, Netflix, and Steam, using 80 phishing templates deployed in five languages, including Arabic, English, French, Spanish, and Hebrew.
Over the past nine years, Group-IB identified more than 20,000 unique domains associated with SniperDz that impersonated at least 30 major global organizations, including PayPal, Facebook, Instagram, Yahoo, Netflix and Steam.
infrastructure 20,000 domains
The phishing platform allowed scammers to target users on around 30 popular platforms, including PayPal, Facebook, Instagram, Netflix, and Steam, via more than 20,000 domains.
Over the past nine years, Group-IB identified more than 20,000 unique domains associated with SniperDz that impersonated at least 30 major global organizations, including PayPal, Facebook, Instagram, Yahoo, Netflix and Steam.
In the years since then, more than 20,000 unique domains associated with the PhaaS service have been identified.
organisation INTERPOL Operation Takes Down Sniper Dz
INTERPOL Operation Takes Down Sniper Dz Phishing Platform, Arrests Administrator.
victims 30 major global organizations
The toolkit primarily targeted 30 major global organizations, including PayPal, Facebook, Instagram, Yahoo, Netflix, and Steam, using 80 phishing templates deployed in five languages, including Arabic, English, French, Spanish, and Hebrew.
Over the past nine years, Group-IB identified more than 20,000 unique domains associated with SniperDz that impersonated at least 30 major global organizations, including PayPal, Facebook, Instagram, Yahoo, Netflix and Steam.
organisation INTERPOL
Interpol Dismantles SniperDz Phishing-as-a-Service Platform.
Tracking the Infrastructure As per the details shared by INTERPOL and Group-IB, this PhaaS network was launched in 2015 but evaded detection for so long because the admins constantly changed its name.
organisation Group-IB
Cybersecurity firm Group-IB has revealed that a recent Interpol-led cybercrime law enforcement operation has led to the takedown of an established phishing-as-a-service (PhaaS) platform and the arrest of its main operator developer.
Tracking the Infrastructure As per the details shared by INTERPOL and Group-IB, this PhaaS network was launched in 2015 but evaded detection for so long because the admins constantly changed its name.
organisation Group
Over the past nine years, Group-IB identified more than 20,000 unique domains associated with SniperDz that impersonated at least 30 major global organizations, including PayPal, Facebook, Instagram, Yahoo, Netflix and Steam.
In 2024, Group-IB cybersecurity researchers detected fake Facebook accounts of politicians in the Middle East and North Africa delivering malicious links.
organisation JokerDz, StormDz
The platform was also known as JokerDz, StormDz, and SpamDz.
organisation SpamDz
The platform was also known as JokerDz, StormDz, and SpamDz.
organisation Guedz
With the support of INTERPOL, slowly, information started emerging; the code’s developer turned out to be a threat actor known online as Guedz.
data_breach 45,000 victim records
The scale of its reach became concrete in 2016, when the platform published statistics showing that campaigns run through its service had already collected more than 45,000 victim records.
Included among them was Guedz, the primary developer and administrator of Sniper Dz, a PhaaS service that's said to have collected more than 45,000 victim records.
organisation Sniper Dz
Included among them was Guedz, the primary developer and administrator of Sniper Dz, a PhaaS service that's said to have collected more than 45,000 victim records.
infrastructure 3,867 compromised endpoints
Over 3,867 compromised endpoints and victims were identified.
‎Jun 12, 2026
Threat actors used INTERPOL's database to identify and target SniperDz in an operation aimed at disrupting the sniper phishing network.
Tactical Metrics
Metrics
infrastructure
53
Malicious Servers
According to INTERPOL’s press release , Operation Ramz covered 13 nations, including Egypt, Morocco, Jordan, and Qatar, leading to 201 arrests and the seizure of 53 malicious servers.
The results, announced by Interpol at the end of May , included 201 arrests, 53 servers seized and 382 suspects and 3867 victims identified.
Metrics
victims
15
Forced Workers
During the mitigation process in Jordan, investigators tracked an investment scam platform run by 15 forced workers.
Metrics
infrastructure
20,000
Domains
The phishing platform allowed scammers to target users on around 30 popular platforms, including PayPal, Facebook, Instagram, Netflix, and Steam, via more than 20,000 domains.
In the years since then, more than 20,000 unique domains associated with the PhaaS service have been identified.
Over the past nine years, Group-IB identified more than 20,000 unique domains associated with SniperDz that impersonated at least 30 major global organizations, including PayPal, Facebook, Instagram, Yahoo, Netflix and Steam.
Metrics
data_breach
45,000
Victim Records
The scale of its reach became concrete in 2016, when the platform published statistics showing that campaigns run through its service had already collected more than 45,000 victim records.
Included among them was Guedz, the primary developer and administrator of Sniper Dz, a PhaaS service that's said to have collected more than 45,000 victim records.
Metrics
infrastructure
3,867
Compromised Endpoints
Over 3,867 compromised endpoints and victims were identified.
Metrics
victims
30
Major Global Organizations
The toolkit primarily targeted 30 major global organizations, including PayPal, Facebook, Instagram, Yahoo, Netflix, and Steam, using 80 phishing templates deployed in five languages, including Arabic, English, French, Spanish, and Hebrew.
Over the past nine years, Group-IB identified more than 20,000 unique domains associated with SniperDz that impersonated at least 30 major global organizations, including PayPal, Facebook, Instagram, Yahoo, Netflix and Steam.
Metrics
victims
3,867
Victims
The results, announced by Interpol at the end of May , included 201 arrests, 53 servers seized and 382 suspects and 3867 victims identified.
Intelligence Sources
HackRead 2026-06-11
The Hacker News 2026-06-12
HackRead 2026-06-11
Infosecurity-Magazine 2026-06-11
The Hacker News 2026-06-12