Operation Ramz Dismantles 53 Servers Used in Scam and Malware Campaigns

A large-scale international cybercrime operation led by INTERPOL has resulted in 201 arrests and the takedown of 53 malicious servers linked to phishing, malware, and online scam campaigns across the Middle East and North Africa (MENA) region.

Dubbed Operation Ramz, the initiative ran from October 2025 to February 2026 and involved law enforcement agencies from 13 countries. Authorities also identified 382 additional suspects and confirmed 3,867 victims affected by various cyber fraud schemes.

Operation Ramz Dismantles 53 Servers

Operation Ramz represents the first coordinated cybercrime enforcement effort of its scale in the MENA region. The operation focused on dismantling malicious infrastructure, disrupting phishing-as-a-service platforms, and investigating organized cybercriminal networks.

Nearly 8,000 intelligence reports and data points were shared among participating countries, enabling faster identification of threat actors and infrastructure.

INTERPOL’s Director of Cybercrime, Neal Jetton, emphasized that global collaboration was critical in addressing borderless cyber threats and dismantling criminal ecosystems.

Law enforcement agencies across multiple countries reported significant findings:

• Qatar: Authorities identified compromised devices unknowingly used to distribute malware. Victims were notified and systems secured.
• Jordan: Police uncovered a financial fraud scheme involving fake investment platforms. Fifteen individuals were found to be trafficking victims forced into cybercrime operations, while two key suspects were arrested.
• Oman: Investigators located a vulnerable server infected with malware inside a private residence and disabled it to prevent further exploitation.
• Algeria: Authorities dismantled a phishing-as-a-service website, seizing servers, devices, and phishing toolkits.
• Morocco: Law enforcement confiscated multiple devices containing banking data and phishing software, leading to ongoing legal proceedings against suspects.

The seizure of 53 servers played a critical role in disrupting ongoing malware campaigns and phishing operations. These servers were used to host malicious scripts, manage botnets, and facilitate financial fraud schemes targeting victims across the region.

Security researchers and private sector partners, including Group-IB, Kaspersky, Shadowserver Foundation, Team Cymru, and Trend Micro, supported the operation by tracking malicious infrastructure and providing actionable threat intelligence.

One of the most notable findings was the connection between cybercrime and human trafficking. In Jordan, individuals involved in scam operations were coerced into participation after being lured with fake job offers, highlighting the evolving complexity of cyber-enabled crime networks.

Participating Countries and Support

The operation included participation from:

• Algeria, Bahrain, Egypt, Iraq, Jordan, Lebanon
• Libya, Morocco, Oman, Palestine, Qatar
• Tunisia and the United Arab Emirates

Operation Ramz was supported by Qatar’s Ministry of Interior and partially funded by the European Union and the Council of Europe under the CyberSouth+ initiative.

Operation Ramz demonstrates how coordinated intelligence sharing and public-private partnerships can effectively disrupt cybercriminal ecosystems.

The success of the operation highlights the increasing need for regional and global cooperation to combat evolving threats such as phishing, malware distribution, and online financial fraud.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.