Back Interpol.Int

45,000 malicious IP addresses taken down in international cyber operation

Interpol.Int • March 13, 2026

LYON, France – An international cybercrime operation targeting phishing, malware and ransomware has taken down more than 45,000 malicious IP addresses and servers.

Law enforcement from 72 countries and territories took part in Operation Synergia III (18 July 2025 – 31 January 2026), coordinated by INTERPOL. The operation led to the arrest of 94 people, with another 110 individuals still under investigation.

During the operation, INTERPOL transformed data into actionable intelligence, facilitated cross-border collaboration, and provided tactical operational assistance to member countries. Preliminary investigations led to a series of coordinated actions by national authorities, including raids on key locations and the disruption of malicious cyber activities. In total 212 electronic devices and servers were seized.

Neal Jetton, INTERPOL’s Director of the Cybercrime Directorate, said:

“Cybercrime in 2026 is more sophisticated and destructive than ever before, but Operation Synergia III stands as a powerful testament to what global cooperation can achieve. INTERPOL remains at the forefront of this fight, uniting law enforcement agencies and private sector experts to dismantle criminal networks, disrupt emerging threats and protect victims around the world.”

Although several investigations are still ongoing in participating countries, preliminary reports of key cases demonstrate the breadth of the criminal tactics employed:

During Operation Synergia III, INTERPOL worked closely with its partners, Group-IB, Trend Micro and S2W, to track illegal cyber activities and identify malicious servers.

Participating countries and territories: Angola, Argentina, Austria, Bahrain, Bangladesh, Bolivia, Bosnia and Herzegovina, Botswana Brazil, Brunei, Burkina Faso, Burundi, Cameroon, Colombia, Democratic Rep of Congo, Eritrea, Eswatini, France, Gambia, Georgia, Greece, Guatemala, Guinea, Guinea Bissau, Guyana, Honduras, Iceland, India, Iraq, Ireland, Israel, Japan, Jordan, Kazakhstan, Kenya, Kuwait, Latvia, Lebanon, Lesotho, Liechtenstein, Macao (China), Madagascar, Malaysia, Maldives, Moldova, Mongolia, Niger, Nigeria, North Macedonia, Oman, Pakistan, Palestine, Paraguay, Philippines, Poland, Qatar, Singapore, South Africa, South Sudan, Spain, Sri Lanka, Switzerland, Tanzania, Togo, Türkiye, Uganda, Ukraine, United Arab Emirates, United Kingdom, Venezuela, Zambia, Zimbabwe.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Operation Synergia III Dismantles 45,000 Malicious IPs, Arrests 94 Worldwide An international cybercrime operation, Operation Synergia III, coordinated by INTERPOL, has dismantled over 45,000 malicious IP addresses and servers linked to phishing, malware, and ransomware attacks. The operation, which took place from July 18, 2025, to January 31, 2026, involved law enforcement from 72 countries and resulted in the arrest of 94 suspects, with an additional 110 individuals under investigation. Key successes included the identification of over 33,000 fraudulent websites in Macau, China, and the arrest of 40 suspects in Bangladesh involved in various cybercrime schemes. In Togo, 10 suspects were arrested for operating a fraud ring specializing in social engineering and hacking. INTERPOL emphasized the growing sophistication of cybercrime in 2026 and the importance of global cooperation in combating these threats. The operation also saw the seizure of 212 electronic devices and servers used in criminal activities. Investigations are ongoing in several participating countries. 29 sources 71

45,000 malicious IP addresses taken down in international cyber operation

The full story

Extracted Entities

Attack Types (3)

Campaigns (1)

Countries (72)