Net Closed: Interpol’s Operation Ramz Bags 200 Cybercriminals and Smashes 53 Command Servers

Interpol has coordinated the apprehension of over 200 individuals implicated in a sophisticated cybercrime matrix operating across the Middle East and North Africa. Designated as Operation Ramz, the multi-jurisdictional law enforcement surge spanned 13 sovereign nations, with investigators successfully identifying an additional 382 high-value suspects.

Throughout the operational deployment, tactical units seized 53 command-and-control servers utilized to orchestrate pervasive phishing campaigns, propagate malicious software payloads, and facilitate complex online financial fraud. Forensic analysis compiled by Interpol indicates that these illicit architectures compromised a minimum of 3,867 verified victims—a baseline metric established following the exhaustive parsing of nearly 8,000 discrete data packets recovered from the confiscated hardware infrastructure.

The synchronized offensive was executed across Algeria, Bahrain, Egypt, Iraq, Jordan, Lebanon, Libya, Morocco, Oman, Palestine, Qatar, Tunisia, and the United Arab Emirates. Interpol clarified that the primary strategic objective focused on the total dismantlement of the underlying phishing frameworks, malware distribution channels, and fraudulent enterprises that continuously inflict severe economic degradation across the region.

To neutralize these threat actors, Interpol forged deep-tier technical alliances with elite private-sector cybersecurity corporations, including Kaspersky Lab, Group-IB, The Shadowserver Foundation, Team Cymru, and TrendAI. These commercial partners provisioned critical threat intelligence, facilitating the real-time tracking of adversarial infrastructure and the discovery of interconnected malicious nodes.

In Qatar, law enforcement personnel successfully insulated a cluster of compromised endpoints that unsuspecting operators had unwittingly transformed into proxies for malware propagation. Concurrently, authorities in Jordan neutralized a predatory, fraudulent investment scheme characterized by human trafficking, liberating 15 exploited East Asian nationals who had been forcefully coerced into executing online scams; two primary orchestrators of the enterprise were taken into custody.

In Oman, specialized cells permanently deactivated a heavily compromised server that had been leaking highly sensitive enterprise data. Meanwhile, cybercrime units in Algeria dismantled a pervasive Phishing-as-a-Service (PaaS) node, resulting in the immediate arrest of a key administrative suspect. In Morocco, forensic seizures yielded a vast cache of electronic terminals and illicit financial credentials directly linked to ongoing phishing endeavors, with several high-tier targets currently undergoing formal judicial prosecution.

Operation Ramz stands as Interpol’s third monumental offensive targeting transnational cybercrime within the current calendar year. In March, the global police organization heralded the conclusion of Operation Synergia III, an initiative that neutralized over 45,000 weaponized IP addresses, confiscated 212 computing terminals and servers, and precipitated the arrest of 94 cross-border adversaries across 72 countries for their involvement in network intrusions, systemic fraud, and malicious payload distribution.

This milestone follows the February execution of Operation Red Card 2.0, a highly targeted surge across 16 African nations that resulted in the detention of 651 suspects. That specific campaign was calibrated to dismantle predatory investment syndicates, mobile payment intercept operations, and fraudulent micro-lending applications—schemes that collectively inflicted aggregate financial damages exceeding $45 million.