Inspector Knacker of the Interpol Yard has fingered the collar of 201 suspects in a MENA cybercrime sweep aimed at phishing gangs, malware crews and scam infrastructure.
The first-of-its-kind operation across the Middle East and North Africa identified another 382 suspects, 3,867 victims and seized 53 servers.
The initiative, codenamed Operation Ramz, ran between October 2025 and February 2026 across 13 countries. It aimed to investigate and neutralise malicious infrastructure, arrest suspects and stop future losses.
“The operation focused on neutralising phishing and malware threats, as well as tackling cyber scams that inflict severe cost to the region,” Interpol said.
Algerian authorities disrupted a phishing-as-a-service outfit after confiscating its server, a computer, a mobile phone and hard drives stuffed with phishing software and scripts. One suspect was arrested in connection with the scheme. Moroccan officials seized computers, smartphones and external hard drives containing banking data and software used for phishing operations.
In Oman, authorities found a legitimate server in a private residence that contained sensitive information. The box had multiple critical security holes and was infected with malware. Interpol said the server was disabled, which sounds like the minimum response when a malware-ridden machine full of sensitive data is sitting in someone’s house.
In Qatar, compromised devices were discovered, with the owners unaware their systems were being used to spread “malicious threats.” The machines were secured, and the owners were told to take appropriate security measures, although Interpol did not specify the exact threats involved.
Jordanian police found a computer used to run financial fraud scams. Victims were tricked into investing assets in what appeared to be a legitimate trading platform, which then vanished once the money arrived.
“A raid uncovered 15 individuals carrying out the scams, but investigators determined that they were victims of human trafficking who had been recruited under the false promise of employment from their home countries in Asia,” Interpol said.
“Upon arrival in Jordan, their passports were confiscated, and they were forced or coerced into participating in the scheme. Two individuals suspected of orchestrating the operation were arrested.”
Group-IB, one of the private sector outfits involved, said it supplied “actionable intelligence” on more than 5,000 compromised accounts. Those accounts included some linked to government infrastructure. The company said it shared details about active phishing infrastructure across the region.
