INTERPOL Operation Ramz Leads to 201 Arrests Across MENA
Summary
INTERPOL says Operation Ramz involved 13 MENA countries, leading to 201 arrests, 382 additional suspects identified and 53 servers seized. Authorities disrupted phishing and fraud operations and identified 3,867 victims.
Key points
- The operation ran from October 2025 to February 2026 across 13 countries; INTERPOL reported 201 arrests, 382 additional suspects identified and 3,867 victims.
- Algerian authorities disrupted a phishing-as-a-service operation, seized its server and related devices, and arrested one suspect.
- Authorities in Morocco seized devices containing banking data and phishing software; in Oman, they disabled a malware-infected server with critical vulnerabilities.
- In Qatar, authorities found compromised devices and secured them; owners were alerted that their systems had been used to spread malicious threats.
- Jordanian police identified a financial-fraud operation involving people INTERPOL said were victims of human trafficking; two suspected organizers were arrested.
- Group-IB said it provided intelligence on more than 5,000 compromised accounts and active phishing infrastructure in the region.
Article Details
- Event Type
- INTERPOL-coordinated, multinational law-enforcement operation targeting cybercrime across the Middle East and North Africa.
- Impact
- According to INTERPOL, Operation Ramz resulted in 201 arrests, 382 additional suspects identified, 3,867 victims identified, and 53 servers seized. Authorities disrupted a phishing-as-a-service operation in Algeria, seized devices containing banking data and phishing software in Morocco, and disabled a malware-infected server in Oman. Compromised devices in Qatar were secured. In Jordan, authorities identified a financial-fraud scheme linked to human trafficking; two suspected organizers were arrested.
People
Threat Actors
Alan BillIdentified as the administrator of Kingdom Market; the article reports that he pleaded guilty to a conspiracy involving, among other things, stolen financial data and malware.CypherExplicitly identified in the article as an alias of Thomasz Szabo, who was sentenced for his role in an online swatting ring.David Jose Gomez CegarraSentenced in connection with ATM jackpotting incidents in the United States, according to the article.GothFerrariExplicitly identified in the article as an alias of Marlon Ferro, who was sentenced in connection with a cryptocurrency theft conspiracy.JonahExplicitly identified in the article as an alias of Thomasz Szabo, who was sentenced for his role in an online swatting ring.Marlon FerroSentenced in connection with a social-engineering conspiracy that stole cryptocurrency from victims, according to the article.Owe Martin AndresenIdentified as the suspected main administrator of the illicit darknet marketplace Dream Market and indicted on money-laundering charges; the article reports his suspected role.PlankExplicitly identified in the article as an alias of Thomasz Szabo, who was sentenced for his role in an online swatting ring.Sohaib AkhterConvicted by a federal jury of deleting databases containing U.S. government information and stealing an individual's plaintext password, according to the article.SpeedstepperExplicitly identified in the article as an alias of Owe Martin Andresen, who was described as the suspected main administrator of Dream Market.Thomasz SzaboSentenced to 48 months in prison for his role as the mastermind of an online swatting ring, according to the article.
Vendors
Group-IBGroup-IB, which was one of the private sector companies that participated in the effort, said it provided “actionable intelligence” on over 5,000 compromised accounts, including those that were associated withTeam Cymru“Cybercrime is borderless, and the only effective response is one that is equally borderless,” Joe Sander, CEO of Team Cymru, said.
Countries
AlgeriaThe action also uncovered compromised systems, victimized users, and trafficking-linked scam operators across multiple countries, including Algeria, Morocco, Oman, Qatar, and Jordan.BahrainCountries that took part in Operation Ramz included Algeria, Bahrain, Egypt, Iraq, Jordan, Lebanon, Libya, Morocco, Oman, Palestine, Qatar, Tunisia, and the U.A.E.EgyptCountries that took part in Operation Ramz included Algeria, Bahrain, Egypt, Iraq, Jordan, Lebanon, Libya, Morocco, Oman, Palestine, Qatar, Tunisia, and the U.A.E.IraqCountries that took part in Operation Ramz included Algeria, Bahrain, Egypt, Iraq, Jordan, Lebanon, Libya, Morocco, Oman, Palestine, Qatar, Tunisia, and the U.A.E.JordanThe action also uncovered compromised systems, victimized users, and trafficking-linked scam operators across multiple countries, including Algeria, Morocco, Oman, Qatar, and Jordan.LebanonCountries that took part in Operation Ramz included Algeria, Bahrain, Egypt, Iraq, Jordan, Lebanon, Libya, Morocco, Oman, Palestine, Qatar, Tunisia, and the U.A.E.LibyaCountries that took part in Operation Ramz included Algeria, Bahrain, Egypt, Iraq, Jordan, Lebanon, Libya, Morocco, Oman, Palestine, Qatar, Tunisia, and the U.A.E.MoroccoThe action also uncovered compromised systems, victimized users, and trafficking-linked scam operators across multiple countries, including Algeria, Morocco, Oman, Qatar, and Jordan.OmanThe action also uncovered compromised systems, victimized users, and trafficking-linked scam operators across multiple countries, including Algeria, Morocco, Oman, Qatar, and Jordan.PalestineCountries that took part in Operation Ramz included Algeria, Bahrain, Egypt, Iraq, Jordan, Lebanon, Libya, Morocco, Oman, Palestine, Qatar, Tunisia, and the U.A.E.QatarThe action also uncovered compromised systems, victimized users, and trafficking-linked scam operators across multiple countries, including Algeria, Morocco, Oman, Qatar, and Jordan.TunisiaCountries that took part in Operation Ramz included Algeria, Bahrain, Egypt, Iraq, Jordan, Lebanon, Libya, Morocco, Oman, Palestine, Qatar, Tunisia, and the U.A.E.U.A.E.Countries that took part in Operation Ramz included Algeria, Bahrain, Egypt, Iraq, Jordan, Lebanon, Libya, Morocco, Oman, Palestine, Qatar, Tunisia, and the U.A.E.