Operation Ramz: INTERPOL Disrupts Cybercrime Networks in MENA Region
Severity: High (Score: 61.7)
Sources: Securityaffairs.Co, Zamin.Uz, Cyberscoop, Morningstar, cts.businesswire.com
Published: · Updated:
Keywords: operation, mena, interpol, ramz, cybercrime, region, phishing
Severity indicators: rat
Summary
Operation Ramz, coordinated by INTERPOL, resulted in 201 arrests and identified 3,867 victims across 13 MENA countries from October 2025 to February 2026. The operation focused on dismantling phishing infrastructure, malware threats, and online scams. Authorities seized 53 servers and identified 382 additional suspects. Investigations revealed that compromised devices in Qatar were unknowingly spreading threats, while a fraudulent investment scheme in Jordan involved victims of human trafficking. In Oman, a vulnerable server was disabled to prevent further harm, and a phishing-as-a-service site was dismantled in Algeria. Nearly 8,000 pieces of intelligence were shared among participating countries to support ongoing investigations. Key Points: • Operation Ramz led to 201 arrests and identified 3,867 victims across 13 MENA countries. • The operation focused on phishing, malware, and online scams, seizing 53 servers. • Cross-border collaboration was crucial, with nearly 8,000 intelligence pieces shared among countries.
Detailed Analysis
**Impact** Operation Ramz targeted cybercrime networks across 13 MENA countries, resulting in 201 arrests and identification of 382 additional suspects. The operation uncovered 3,867 victims affected by phishing, malware, and financial fraud schemes, impacting sectors including government infrastructure, financial services, and individual users. Seizures included 53 servers and multiple devices containing banking data and phishing tools, with significant operational disruption to cybercriminal infrastructure in Algeria, Jordan, Morocco, Oman, and Qatar. **Technical Details** The operation focused on phishing campaigns, malware distribution, and online scams, including phishing-as-a-service platforms and fraudulent investment schemes. Attackers exploited compromised devices, malware-infected servers with critical vulnerabilities, and phishing infrastructure to harvest credentials and distribute malicious payloads. Human trafficking was used to coerce victims into conducting fraud operations. No specific CVEs or malware families were detailed in the sources. Indicators of compromise include seized servers, phishing software, scripts, and banking data repositories. **Recommended Response** Defenders should prioritize securing and monitoring credential databases and phishing infrastructure, applying patches to vulnerable servers, and remediating malware infections on compromised devices. Organizations must enhance detection of phishing campaigns and fraudulent platforms, and monitor for unusual account activity indicative of credential compromise. Collaboration with law enforcement and threat intelligence sharing is advised to track evolving adversary infrastructure. No specific CVEs or IOCs were provided for direct blocking.
Source articles (27)
- 201 arrests in first-of-its-kind cybercrime operation in MENA region — Interpol.Int · 2026-05-18
SINGAPORE – A first-of-its-kind cybercrime operation in the MENA region has led to the arrest of 201 individuals, with a further 382 suspects identified. Thirteen countries from the Middle East and No… - Group-IB supports INTERPOL's Operation Ramz, contributing intelligence to first MENA ... — Group-Ib · 2026-05-18
Group-IB, a leading creator of predictive cybersecurity technologies to investigate, prevent, and fight digital crime, today announced its contribution to INTERPOL-coordinated Operation Ramz, the firs… - 201 arrested in INTERPOL disruption of phishing and fraud networks — Feeds2.Feedburner · 2026-05-18
Operation Ramz, a cybercrime initiative coordinated by INTERPOL across the MENA region, focused on disrupting phishing campaigns, malware activity, and cyber scams that caused substantial financial lo… - Team Cymru Supports INTERPOL's Operation Ramz, Helping Disrupt Cybercrime Across ... — Morningstar · 2026-05-18
Team Cymru Supports INTERPOL’s Operation Ramz, Helping Disrupt Cybercrime Across the MENA Region First-of-its-kind 13-country INTERPOL operation results in 201 arrests, identification of 3,867 victims… - 201 arrests in first-of-its-kind cybercrime operation in MENA region — Interpol.Int · 2026-05-18
SINGAPORE – A first-of-its-kind cybercrime operation in the MENA region has led to the arrest of 201 individuals, with a further 382 suspects identified. Thirteen countries from the Middle East and No… - Kaspersky supports INTERPOL's Operation Ramz in MENA region, resulting in over 200 arrests — Kaspersky · 2026-05-18
Kaspersky has recently contributed its industry recognized threat intelligence data to Operation Ramz, an INTERPOL-coordinated cybercrime crackdown across the Middle East and North Africa (MENA) regio… - Kaspersky Supports INTERPOL Cybercrime Crackdown Across MENA Region — Techafricanews · 2026-05-18
Operation Ramz marked a milestone as the first cyber operation of such a scale coordinated by INTERPOL in the MENA region. Kaspersky has recently contributed its industry recognised threat intelligenc… - Interpol Launches Sweeping Cybercrime Crackdown in MENA Region — Infosecurity-Magazine · 2026-05-18
International law enforcement agency Interpol has coordinated a first-of-its-kind cybercrime crackdown across the Middle East and North Africa (MENA) that led to 201 arrests. The effort, dubbed Operat… - Interpol dismantles cyber fraud networks targeting 4000 victims in 13 Arab states — Gulfnews · 2026-05-18
Dubai: Interpol announced on Monday that a large-scale cybercrime operation across the Middle East and North Africa led to identifying nearly 4,000 victims and hundreds of suspects linked to online fr… - INTERPOL Operation Ramz Disrupts MENA Cybercrime Networks with 201 Arrests — Thehackernews · 2026-05-18
Learn how to stop patient zero attacks before they bypass detection and compromise your systems at entry points. Learn how to validate real attack paths and reduce exploitable risk with continuous age… - Interpol leads cybercrime crackdown across 13 countries in Middle East, North Africa — Cyberscoop · 2026-05-18
Interpol coordinated an expansive investigation with 13 countries in the Middle East and North Africa to disrupt and take down cybercrime operations, including phishing services and tools, malware and… - INTERPOL ‘Operation Ramz’ seizes 53 malware, phishing servers — Bleepingcomputer · 2026-05-18
More than 200 individuals were arrested for cybercrime activities during INTERPOL's Operation Ramz, which focused on the Middle East and North Africa. Law enforcement also identified another 382 suspe… - INTERPOL Busts Massive Cybercrime Network Across MENA, 201 Arrested — Thecyberexpress · 2026-05-19
A large-scale cybercrime crackdown led by INTERPOL has resulted in 201 arrests and the identification of 3,867 victims across the Middle East and North Africa region. The coordinated operation, known… - Massive MENA cybercrime Operation Ramz disrupts infrastructure and arrests 201 suspects — Securityaffairs.Co · 2026-05-19
INTERPOL led Operation Ramz in MENA, resulting in 201 arrests and 382 suspects tied to cybercrime networks. INTERPOL coordinated Operation Ramz across the Middle East and North Africa, leading to 201… - Operation Ramz Dismantles 53 Servers Used in Scam and Malware Campaigns — Gbhackers · 2026-05-19
A large-scale international cybercrime operation led by INTERPOL has resulted in 201 arrests and the takedown of 53 malicious servers linked to phishing, malware, and online scam campaigns across the… - Scam Centers Under Pressure as INTERPOL Makes More Arrests — Bitdefender · 2026-05-19
INTERPOL has announced a “first-of-its-kind cybercrime operation” that has led to 201 arrests. Authorities across the Middle East and North Africa (MENA) have identified a further 382 suspects. The co… - Interpol's Ramz raid collars 201 cybercrime suspects — Fudzilla · 2026-05-19
Inspector Knacker of the Interpol Yard has fingered the collar of 201 suspects in a MENA cybercrime sweep aimed at phishing gangs, malware crews and scam infrastructure. The first-of-its-kind operatio… - Operation Ramz Seizes 53 Servers Linked to Cyber Scams and Malware Threats — Cybersecuritynews · 2026-05-19
A large-scale international cybercrime crackdown dubbed Operation Ramz has led to the seizure of 53 servers, the arrest of 201 individuals, and the identification of 382 additional suspects across the… - Scam Centers Under Pressure as INTERPOL Makes More Arrests — Bitdefender · 2026-05-19
INTERPOL has announced a “first-of-its-kind cybercrime operation” that has led to 201 arrests. Authorities across the Middle East and North Africa (MENA) have identified a further 382 suspects. The co… - INTERPOL arrests 201 in MENA cybercrime sweep — Itweb.Africa · 2026-05-19
An INTERPOL cybercrime operation across the Middle East and North Africa (MENA) region has led to the arrest of 201 individuals, while a further 382 suspects have been identified. According to the int… - 201 Arrests In First Of Its Kind Cybercrime Operation In MENA Region — www.interpol.int · 2026-05-19
SINGAPORE – A first-of-its-kind cybercrime operation in the MENA region has led to the arrest of 201 individuals, with a further 382 suspects identified. Thirteen countries from the Middle East and No… - Interpol's 'Operation Ramz' Pioneers Cross — Darkreading · 2026-05-20
Breaking cybersecurity news, news analysis, commentary, and other content from around the world, with an initial focus on the Middle East & Africa and the Asia Pacific While the numbers are modest, th… - Team Cymru supports Interpol's Operation Ramz targeting phishing, malware, cyber scam ... — Industrialcyber.Co · 2026-05-20
Team Cymru, vendor of external threat intelligence and internet visibility, announced its role as a private-sector partner in Operation Ramz, a first-of-its-kind cybercrime operation in the Middle Eas… - Team Cymru Supports INTERPOLs Operation Ramz Helping Disrupt Cybercrime Across The MENA Region — www.businesswire.com · 2026-05-20
Team Cymru Supports INTERPOL’s Operation Ramz, Helping Disrupt Cybercrime Across the MENA Region First-of-its-kind 13-country INTERPOL operation results in 201 arrests, identification of 3,867 victims… - Kaspersky Lab participated in Interpol's new cyber operation — Zamin.Uz · 2026-05-25
Kaspersky Lab supported Interpol in Operation Synergia, aimed at combating cybercrime in the Middle East and North Africa regions. According to the company's press service, critical information cyber…
Timeline
- 2025-10-01 — Operation Ramz initiated: INTERPOL launched Operation Ramz to combat cybercrime across the MENA region.
- 2026-02-28 — Operation Ramz concluded: The operation concluded with 201 arrests and the identification of 3,867 victims.
- 2026-05-18 — Operation Ramz details released: INTERPOL announced the results of Operation Ramz, highlighting the arrests and seized servers.
Related entities
- Malware (Attack Type)
- Phishing (Attack Type)
- Operation Ramz (Campaign)
- Operation Red Card 2.0 (Campaign)
- Operation Synergia III (Campaign)
- Rameses (Campaign)
- Algeria (Country)
- Bahrain (Country)
- Egypt (Country)
- Iraq (Country)
- Jordan (Country)
- Kuwait (Country)
- Lebanon (Country)
- Libya (Country)
- Morocco (Country)
- Oman (Country)
- Palestine (Country)
- Philippines (Country)
- Qatar (Country)
- Tunisia (Country)
- United Arab Emirates (Country)
- businesswire.com (Domain)
- fraud.in (Domain)
- stealth-pr.com (Domain)
- [email protected] (Email)
- Financial (Industry)
- Government (Industry)
- T1071 - Application Layer Protocol (Mitre Attack)
- T1566 - Phishing (Mitre Attack)