Group-Ib SniperDz Phishing-as-a-Service Platform Dismantled by INTERPOL
Article Content
- •SniperDz was a major PhaaS platform operating since at least 2015, facilitating phishing attacks.
- •The INTERPOL-led operation resulted in 201 arrests and the seizure of 53 servers across 13 countries.
- •Group-IB identified over 140,000 phishing pages linked to SniperDz, targeting major global brands.
A coordinated investigation led by INTERPOL and the Algerian National Police resulted in the dismantling of SniperDz, a phishing-as-a-service (PhaaS) platform that operated since at least 2015. Group-IB played a crucial role in this operation, which led to the arrest of the primary developer and 201 additional arrests across 13 countries in the MENA region. SniperDz was responsible for over 140,000 phishing pages and targeted more than 30 global organizations, including PayPal and Netflix. The platform provided ready-made phishing kits and exploited social engineering techniques, impersonating public figures to lure victims. The investigation revealed significant operational security failures by the suspect, including the publication of video tutorials that exposed sensitive information. The operation also seized 53 servers and identified nearly 4,000 victims. This takedown marks a significant victory in combating cybercrime in the region.
Ask AI about this cluster
Answers cite the sources they use
Timeline
More articles in this cluster (7)
Following this threat?
Track Netflix in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.
Free account · no card needed
Continue Reading
Critical BeyondTrust 9.3 Vulnerability Actively Exploited by Threat Actor A critical vulnerability (CVE-2026-102764) in BeyondTrust Remote Support has been discovered and is actively being exploited by the threat group ARMORY CASTLE, reportedly linked to China. The vulnerability, which has a CVSS score of 9.3, allows unauthenticated attackers to upload files and potentially compromise host… 
Lazarus APT Launches Operation FlashHole Using AI and Post-Quantum Cryptography Kaspersky has identified a cyberespionage campaign, dubbed Operation FlashHole, attributed to the Lazarus APT group, active since July 2025. The campaign has targeted at least three organizations in South Korea's construction, software, and wire-communication sectors. Attack methods include spear-phishing emails…