Global Authorities Take Down 45,000 Malicious IPs Used in Ransomware Campaigns

An international law enforcement operation has successfully dismantled a significant cybercrime network. Coordinated by INTERPOL, the initiative targeted infrastructure used in phishing, malware, and ransomware campaigns globally.

The operation, named "Operation Synergia III," was conducted from Fri, Jul 18, 2025, to Sat, Jan 31, 2026. It involved law enforcement agencies from 72 countries and territories, focusing on disrupting digital infrastructures used for cyber threats.

The operation resulted in the takedown of over 45,000 malicious IP addresses and servers used for launching attacks and hosting stolen data. Additionally, 94 individuals were arrested, with 110 suspects under investigation. Law enforcement seized 212 electronic devices, significantly disrupting several cybercriminal operations.

INTERPOL facilitated cross-border collaboration, allowing local authorities to conduct coordinated raids on key cybercriminal locations.

Preliminary reports indicate a wide range of criminal tactics were disrupted, including corporate ransomware and social engineering schemes. Key regional actions include:

In Macau, authorities dismantled over 33,000 phishing and fraudulent websites impersonating banks and government portals. In Bangladesh, a sweep resulted in 40 arrests and the seizure of 134 devices linked to job scams and credit card fraud. In Togo, a 10-person fraud ring involved in social media hacking and scams was dismantled.

The success of Operation Synergia III was due to cooperation between international police forces and private cybersecurity firms, including Group-IB, Trend Micro, and S2W. These partners helped track illegal activities and identify malicious infrastructures.

INTERPOL's Cybercrime Directorate highlighted the importance of global cooperation in combating sophisticated cyber threats in 2026.

Based on reporting by GBHackers.