Photo by Jon Tyson on Unsplash
- INTERPOL's Operation Ramz concluded February 28, 2026, after a four-month sweep across 13 Middle East and North Africa nations — resulting in 201 arrests and the formal identification of 382 additional suspects.
- 53 servers used for phishing, malware distribution, and online fraud were seized; authorities extracted nearly 8,000 intelligence packages from captured equipment and logged 3,867 confirmed victims.
- A Jordan raid uncovered 15 Asian workers trafficked and coerced into running digital fraud operations — documenting the cybercrime-human trafficking convergence that was previously associated primarily with Southeast Asia.
- Private-sector firms including Kaspersky, Group-IB, Shadowserver, Team Cymru, and TrendAI served as operational intelligence partners, reinforcing the growing model of commercial threat intelligence driving law enforcement takedowns.
What Happened
53. That is the number of servers INTERPOL pulled offline across 13 nations in a single coordinated action — and the infrastructure those servers were running tells a more alarming story than the count alone. According to BleepingComputer, which first reported the operation's results, INTERPOL's Operation Ramz ran from October 2025 through February 28, 2026, making it the agency's most expansive cybercrime enforcement effort in the Middle East and North Africa (MENA) region to date.
The participating nations — Algeria, Bahrain, Egypt, Iraq, Jordan, Lebanon, Libya, Morocco, Oman, Palestine, Qatar, Tunisia, and the UAE — acted on nearly 8,000 intelligence packages disseminated among law enforcement agencies throughout the operation's duration. The cumulative results: 201 individuals arrested, 382 additional suspects formally identified (bringing the total to 583 implicated individuals), 3,867 confirmed victims, and the seizure of 53 servers that formed the backbone of regional phishing, malware, and fraud operations.
Each country's raids surfaced distinct threat actor profiles. In Algeria, authorities dismantled a phishing-as-a-service (PhaaS) platform — a criminal subscription model in which a technical operator builds and rents phishing infrastructure to less-skilled fraudsters — seizing a server, computers, a mobile phone, and hard drives loaded with phishing scripts, and arresting one suspect. In Morocco, three individuals faced judicial proceedings after devices containing banking data and phishing toolkits were recovered. The data protection implications of those seized drives extend well beyond the immediate arrests.
The operation's most consequential finding, however, came from Jordan. A raid targeting an investment fraud compound uncovered 15 workers trafficked from Asia whose passports had been confiscated by two organizers who coerced them into running digital fraud schemes. Both organizers were arrested. The discovery marks the formal documentation of a cybercrime-human trafficking nexus in the MENA region — a pattern that threat intelligence analysts had been watching migrate westward from Southeast Asia's well-publicized scam compounds.
Why It Matters for Your Organization's Security
The PhaaS platforms seized during Operation Ramz were not cottage operations. Group-IB, one of the commercial threat intelligence partners embedded in the enforcement effort, reported that it "identified and mapped active phishing infrastructure across MENA, providing intelligence on two distinct threat actor clusters: those responsible for the creation and distribution of phishing resources, and separate actors engaged in the sale and distribution of leaked data." That division of labor — builders versus distributors — is the hallmark of a mature criminal supply chain, not opportunistic lone actors.
Group-IB also provided actionable intelligence on more than 5,000 compromised accounts extracted during the investigation, a significant portion of which were associated with government infrastructure across the MENA region. For enterprise security teams assessing their own data protection posture, that figure carries a direct implication: the same credential-harvesting infrastructure targeting MENA government systems is available to threat actors operating against financial services, healthcare, and critical infrastructure globally. PhaaS ecosystems do not confine their client base by geography.
Chart: Operation Ramz produced 201 arrests and formally identified 382 additional suspects — a total of 583 implicated individuals — while taking 53 criminal servers offline across 13 MENA nations.
Kaspersky's Threat Research expertise center contributed a separate layer of technical data: command-and-control (C&C) server intelligence — information identifying the centralized systems that threat actors use to remotely direct malware already installed on compromised machines. C&C infrastructure is the nervous system of an active malware campaign, and mapping it is a prerequisite for effective incident response. The fact that Kaspersky's contributions were operational — not just advisory — signals how deeply private threat intelligence has integrated into formal law enforcement workflows.
INTERPOL's Operation Ramz follows the enforcement template established by Operation Synergia II in 2024 and Operation Serengeti, an Africa-focused sweep also in late 2024. Each successive operation has expanded private-sector participation, shortened the gap between threat intelligence collection and enforcement action, and produced larger suspect counts. The trajectory suggests that cybercrime enforcement in emerging market regions is accelerating — but it also means that threat actors who survive takedowns are likely to reconstitute on less-monitored infrastructure. Cybersecurity best practices for organizations with MENA regional exposure should account for this displacement effect: when a PhaaS platform is seized, its client base migrates, not disappears.
Security awareness among employees remains a critical compensating control (a protective measure deployed when a technical fix alone is insufficient). Phishing campaigns that originate from commercial PhaaS infrastructure are often indistinguishable at the individual email level from legitimate correspondence. The 3,867 confirmed victims identified in Operation Ramz represent only those that investigators could directly attribute — the actual victim population is almost certainly larger.
The AI Angle
The intelligence architecture that made Operation Ramz operationally viable offers a blueprint for enterprise defenders. Group-IB and Kaspersky did not produce their contributions through manual investigation alone — both firms leverage machine-learning models trained on global phishing telemetry to identify and cluster infrastructure by threat actor fingerprint. That capability — mapping two distinct actor clusters operating distinct roles within the same PhaaS ecosystem — is precisely the pattern-recognition task at which AI-assisted threat intelligence platforms excel.
Tools such as Recorded Future, Mandiant Advantage, and Group-IB's own Threat Intelligence platform ingest C&C server data, phishing kit signatures, and leaked credential sets to surface active infrastructure before it reaches enterprise inboxes. For security operations teams, integrating these feeds into a SIEM (Security Information and Event Management system — a platform that aggregates and analyzes security data from across an organization) enables real-time blocking of known-bad infrastructure the moment it appears in law enforcement or commercial threat intelligence. The Operation Ramz dataset — nearly 8,000 intelligence packages — represents exactly the kind of structured IOC (indicator of compromise) feed that AI-powered detection systems can operationalize within hours of publication. Security awareness training platforms are also beginning to incorporate live PhaaS kit signatures into simulated phishing campaigns, using the same intelligence pipelines that fed Operation Ramz.
What Should You Do? 3 Action Steps
If your organization has vendors, customers, or infrastructure exposure in the MENA region, the 5,000-plus compromised accounts Group-IB identified — including government-linked credentials — represent a direct supply chain risk. Commercial threat intelligence subscriptions from Group-IB, Recorded Future, or Shadowserver provide structured IOC feeds that security teams can push directly into firewalls and email gateways. Ship this control today: confirm that your current threat intelligence feeds include MENA-specific phishing infrastructure and update blocking rules accordingly. This is a foundational cybersecurity best practice for any organization with regional exposure.
Phishing-as-a-service kits generate campaigns that rotate domains and infrastructure rapidly, which means traditional domain-block lists go stale within hours. Effective incident response for PhaaS-sourced attacks requires behavioral detection — flagging credential-harvesting behavior rather than specific URLs. Review your email security gateway configuration and confirm that link-following sandbox analysis (automatic detonation of URLs in a safe environment before delivery) is active for all inbound mail. Update your incident response runbook to include a PhaaS-specific triage path that escalates credential exposure events to a password reset workflow within 30 minutes of detection.
The Jordan discovery — 15 trafficked workers operating fraud infrastructure under coercion — introduces a due diligence dimension that most cybersecurity best practices frameworks have not yet addressed. Organizations that use contact centers, customer service vendors, or outsourced operations in regions with documented cyber-scam compound activity should include vendor audits as part of their data protection programs. Specifically, confirm that vendor contracts include labor practice certifications and that security awareness training for staff who interact with third-party vendors includes guidance on recognizing coerced-participant scenarios. This is not hypothetical risk: INTERPOL's documentation of the pattern in MENA means it is now a formally recognized threat vector, not an edge case.
Frequently Asked Questions
How can small businesses protect themselves from phishing-as-a-service attacks targeting their region?
Phishing-as-a-service platforms lower the technical barrier for attackers, meaning small businesses face the same sophisticated infrastructure as large enterprises. The most effective layered defense combines email authentication protocols (SPF, DKIM, and DMARC — standards that verify whether an email genuinely originated from the claimed domain), multi-factor authentication (MFA) on all employee accounts, and regular security awareness training that includes simulated phishing exercises. Subscribing to a threat intelligence feed — many vendors offer SMB-tier pricing — allows automated blocking of known PhaaS infrastructure. For data protection, ensure that credential-stuffing alerts (notifications triggered when known leaked username-password pairs are tested against your login systems) are active on all public-facing applications.
What does phishing-as-a-service mean and why is it harder to stop than traditional phishing?
Phishing-as-a-service operates like a legitimate software subscription: a technical operator builds a phishing kit — complete with spoofed login pages, email templates, and automated credential-harvesting back-ends — and rents it to non-technical criminals who handle victim targeting. This model is harder to stop than traditional phishing for two reasons. First, the infrastructure rotates constantly: domains, hosting providers, and sender addresses change on short cycles to evade block lists. Second, the division of labor means taking down one operator does not eliminate the kits already distributed to clients. Effective incident response requires behavioral detection rather than static block lists, and threat intelligence that tracks kit signatures across operator transitions.
How did INTERPOL use private company threat intelligence in Operation Ramz and what does that mean for defenders?
Operation Ramz relied on structured intelligence contributions from Kaspersky (C&C server mapping and region-specific malware infrastructure data), Group-IB (active phishing infrastructure mapping and 5,000-plus compromised account records), Shadowserver, Team Cymru, and TrendAI. These firms provided actionable indicators of compromise that law enforcement used to build cases and execute raids. For enterprise defenders, this public-private model is directly replicable: the same threat intelligence products that fed Operation Ramz are commercially available. Integrating these feeds into a SIEM enables real-time detection of infrastructure that law enforcement and intelligence firms are actively tracking, effectively giving security teams access to the same data that drove one of INTERPOL's largest regional takedowns.
What are the cybersecurity best practices for organizations with vendor or supply chain exposure in MENA countries?
Organizations operating in or sourcing from MENA face a threat landscape that Operation Ramz has now formally characterized: mature PhaaS ecosystems, government-credential targeting, and — as the Jordan case documented — potential exposure to coerced-participant fraud rings operating through vendor relationships. Cybersecurity best practices for this exposure profile include: geo-specific threat intelligence feeds covering MENA infrastructure; third-party vendor security audits with explicit labor practice components; multi-factor authentication on all systems accessible to regional partners; and data protection controls that segment MENA-region data access to minimize blast radius in the event of a credential compromise. Annual security awareness training should be updated to reflect the INTERPOL-documented convergence of cybercrime and human trafficking in the region.
How do authorities identify and seize malware and phishing servers across multiple countries simultaneously?
Multi-jurisdictional server seizures like Operation Ramz require a coordination infrastructure that runs parallel to the technical one. INTERPOL's I-24/7 secure communications network allows member country law enforcement agencies to share case data and coordinate raid timing in real time. Private-sector partners provide the technical intelligence layer: firms like Group-IB map phishing infrastructure to specific hosting providers and IP ranges, then share structured IOC packages with each participating country's cyber unit. Those packages inform the legal applications for search warrants and hosting provider cooperation notices. The nearly 8,000 intelligence packages disseminated during Operation Ramz represent the structured output of that private-sector data pipeline — essentially a standardized dossier per target that each country's law enforcement could act on independently within a coordinated timeline. For enterprise incident response teams, this same package-based model is the architecture behind modern threat intelligence sharing consortia like the FS-ISAC (Financial Services Information Sharing and Analysis Center).
Disclaimer: This article is editorial commentary for informational purposes only and does not constitute professional security consulting advice. Facts reported here are drawn from publicly available sources including BleepingComputer, Kaspersky's official press release, and Group-IB's official press release on Operation Ramz. Always consult with a qualified cybersecurity professional for guidance specific to your organization's security posture and risk environment.