Kaspersky has recently contributed its industry recognized threat intelligence data to an INTERPOL-coordinated operation Ramz, a cybercrime crackdown across the Middle East and North Africa (MENA) region. The law enforcement action that brought together 13 countries* resulted in the arrest of 201 individuals and the identification of further 382 suspects linked to cybercrimes across the region.
Running from October 2025 to February 2026, the operation focused on neutralizing phishing and malware threats along with cyber scams that left nearly 4,000 individuals as victims. The joint effort aimed to disrupt malicious infrastructure, and identify and arrest attackers to prevent future losses.
To facilitate the operation conduct, Kaspersky Threat Research expertise center has provided its partner law enforcement agency with the technical data on region-specific cyberthreats and malicious infrastructures involved in controlling or distributing malware, including data on the malware command and control (C&C) servers.
Operation Ramz marked a milestone as the first cyber operation of such a scale coordinated by INTERPOL in the MENA region. During this effort, nearly 8,000 pieces of crucial data and intelligence were disseminated among participating countries to initiate and support investigations.
Neal Jetton, INTERPOL’s Director of Cybercrime, said: “In a world where cybercriminals exploit the digital landscape without borders, Operation Ramz demonstrates the effectiveness of global collaboration. INTERPOL is dedicated to working with its member countries and private sector partners to take down malicious infrastructure, disrupt criminal groups and bring perpetrators to justice.”
“Operation Ramz shows how the synergy between law enforcement agencies and private sector experts can dismantle sophisticated cybercrime networks at scale,” noted Yuliya Shlychkova, the VP of Global Public Affairs at Kaspersky. “By delivering timely, high quality threat intelligence, we empower investigators to act swiftly, safeguard users, and ultimately make the digital ecosystem safer for everyone.”
Operation Ramz highlights:
• Qatar — Intelligence obtained through Operation Ramz led to the identification of compromised devices. The affected systems were immediately secured, and device owners were notified to take the necessary preventive measures.
• Jordan — Police pinpointed the location of a computer being used to run financial fraud scams. Victims were persuaded to invest through what appeared to be a legitimate trading platform, which shut down once funds had been deposited. A raid uncovered 15 individuals carrying out the scams. Two individuals suspected of orchestrating the operation were arrested.
• Oman — Investigators in Oman identified a server in a private residence that contained sensitive information. Actions were taken to disable the server to prevent additional harm.
• Algeria — A website offering phishing as a service was identified and dismantled as part of Operation Ramz. After locating the suspicious server, authorities successfully seized a server, a computer, a mobile phone and hard drives containing phishing software and scripts. One suspect was taken into custody.
• Morocco — Authorities seized computers, smartphones and external hard drives containing banking data and software used for phishing operations. As a result, three individuals are undergoing judicial procedures, while others remain under investigation.
Kaspersky has been a firm advocate for a collaborative approach in combating cybercrime, providing law enforcement agencies and partner organizations with tactical and strategical data on cyberthreats. Kaspersky Threat Intelligence provides visibility into more than 300 threat actors and over 500 malicious campaigns.
