INTERPOL Operation Ramz Disrupts MENA Phishing Networks – 201 Arrests, 3,867 Victims, 53 Servers Seized
What Happened – INTERPOL coordinated a multi‑nation crackdown (Operation Ramz) across the Middle East and North Africa, targeting phishing‑as‑a‑service platforms, malware‑driven fraud kits and related infrastructure. The effort led to 201 arrests, the identification of 382 additional suspects, the seizure of 53 servers and the collection of thousands of devices containing banking data and phishing tools.
Why It Matters for TPRM –
- Phishing‑as‑a‑service ecosystems can be leveraged by compromised third‑party vendors to launch attacks against your customers.
- The operation uncovered vulnerable “legitimate” servers being abused, highlighting the risk of hidden malicious activity in supplier environments.
- Cross‑border collaboration shows that threat intelligence sharing can rapidly surface supply‑chain threats that would otherwise remain invisible.
Who Is Affected – Financial services firms, payment processors, SaaS platforms handling user credentials, and any organization that outsources IT or cloud resources to entities in the MENA region.
Recommended Actions –
- Review contracts with MENA‑based suppliers for phishing‑as‑a‑service exposure.
- Verify that all third‑party assets are continuously monitored for malicious scripts or unauthorized traffic.
- Incorporate threat‑intel feeds from INTERPOL, Group‑IB, Kaspersky and similar partners into your vendor risk program.
Technical Notes – The takedown targeted phishing kits, malware loaders, and compromised servers running outdated software with known vulnerabilities. No specific CVE was disclosed, but the servers exhibited classic misconfiguration and malware infection patterns. Source: Help Net Security