INTERPOL Operation Ramz: Major Cybercrime Crackdown Across MENA Results in 201 Arrests

Key Findings

• INTERPOL coordinated Operation Ramz across 13 MENA countries from October 2025 to February 2026, resulting in 201 arrests and 382 additional suspects identified

• Nearly 8,000 intelligence records were shared between participating nations, marking the largest coordinated cybercrime effort INTERPOL has led in the region

• Authorities identified 3,867 victims and seized 53 servers involved in phishing, malware, and cyber scam operations

• Private sector partners including Group-IB, Kaspersky, Shadowserver Foundation, Team Cymru, and Trend Micro provided critical infrastructure tracking and investigative support

Background

Operation Ramz represented a first-of-its-kind cybercrime crackdown for the MENA region, bringing together law enforcement from Algeria, Bahrain, Egypt, Iraq, Jordan, Lebanon, Libya, Morocco, Oman, Palestine, Qatar, Tunisia, and the U.A.E. The five-month operation aimed to investigate and disrupt malicious infrastructure, identify and arrest suspects, and prevent future financial losses from digital attacks. According to Neal Jetton, INTERPOL's Director of Cybercrime, the operation demonstrated how global collaboration could effectively combat criminals who operate without borders.

Infrastructure Dismantling and Regional Operations

The operation uncovered distinct cybercrime schemes across multiple countries. In Algeria, authorities dismantled a phishing-as-a-service operation, seizing servers, devices, tools, and arresting one suspect. Morocco's authorities confiscated computers, smartphones, and hard drives containing banking data and phishing software, with multiple suspects remaining under investigation. In Oman, a vulnerable server hosting sensitive data was secured after being found infected with malware. Qatar saw compromised devices being used unknowingly to spread malware; authorities secured the systems and notified their owners.

Human Trafficking and Fraud Schemes

Jordanian police uncovered a particularly troubling operation involving forced labor and financial fraud. Investigators discovered 15 individuals operating investment scams through a fraudulent trading platform, but determined that the workers were human trafficking victims. These individuals had been recruited in their home countries in Asia with false employment promises, had their passports confiscated upon arrival, and were coerced into participating in the scheme. Two suspects suspected of orchestrating the trafficking and fraud operation were arrested.

International Collaboration and Intelligence Sharing

Private sector cybersecurity companies played a crucial role in Operation Ramz's success. Group-IB provided actionable intelligence on over 5,000 compromised accounts, including those linked to government infrastructure, and shared details about active phishing infrastructure across the region. Team Cymru's CEO emphasized that cybercrime's borderless nature required an equally borderless response, with law enforcement and trusted private-sector partners pooling intelligence and dismantling criminal infrastructure together.

Sources

• https://securityaffairs.com/192357/cyber-crime/massive-mena-cybercrime-operation-ramz-disrupts-infrastructure-and-arrests-201-suspects.html

• https://thehackernews.com/2026/05/interpol-operation-ramz-disrupts-mena.html

• https://www.kaspersky.com/about/press-releases/kaspersky-supports-interpols-operation-ramz-in-mena-region-resulting-in-over-200-arrests

• https://www.businesswire.com/news/home/20260518604133/en/Team-Cymru-Supports-INTERPOLs-Operation-Ramz-Helping-Disrupt-Cybercrime-Across-the-MENA-Region