Authorities Crack Down on 45,000 Malicious IPs Powering Ransomware Attacks

In a massive international crackdown on cybercrime, law enforcement agencies from 72 countries have successfully dismantled over 45,000 malicious IP addresses and servers.

Coordinated by INTERPOL, “Operation Synergia III” targeted the critical infrastructure behind devastating ransomware, malware, and phishing campaigns worldwide.

Running from July 18, 2025, to January 31, 2026, the operation highlights unprecedented cross-border collaboration.

By transforming raw data into actionable threat intelligence, INTERPOL provided member countries with the tactical support needed to execute localized raids and disrupt major cybercriminal networks.

Threat actors heavily rely on these IP networks to host command-and-control (C2) servers, launch ransomware payloads, and manage fraudulent web properties.

Operational Scope and Impact

To achieve these widespread takedowns, INTERPOL partnered with prominent private-sector cybersecurity firms, including Group-IB, Trend Micro, and S2W.

These partnerships were crucial in tracking illicit activities across the internet and identifying the specific servers powering global attacks.

The six-month operation yielded significant results:

• 45,000+ malicious IPs and command servers disabled.
• 94 individuals arrested across multiple international jurisdictions.
• 110 suspects are currently under active investigation.
• 212 electronic devices and servers were seized for further forensic analysis.

Global Syndicates and Tactics Disrupted

While the operation had a global footprint, preliminary reports highlight several key victories against diverse cybercriminal tactics, ranging from highly technical exploits to manipulative social engineering:

• Macau, China: Authorities identified and neutralized over 33,000 fraudulent websites. These phishing sites impersonated critical infrastructure, including official banking portals, government services, payment platforms, and online casinos. The sites were specifically designed to harvest sensitive personal data and steal credit card details from unsuspecting victims.
• Bangladesh: Law enforcement arrested 40 suspects and confiscated 134 electronic devices. The arrested individuals were linked to a wide array of financial cybercrimes, including extensive identity theft, credit card fraud, and elaborate loan and job scams.
• Togo: Police apprehended a 10-person fraud ring operating from a residential compound. The group’s activities ranged from technical network hacking to complex social engineering. After compromising social media accounts, the attackers impersonated victims to launch romance scams, sextortion campaigns, and fraudulent money transfer requests targeting the victims’ friends and families.

As cyber threats continue to mature, the success of Operation Synergia III demonstrates the effectiveness of unified global action.

Neal Jetton, INTERPOL’s Director of the Cybercrime Directorate, emphasised that while cybercrime in 2026 is more destructive and sophisticated than ever, international cooperation remains the strongest defence.

By uniting global law enforcement and private threat intelligence, authorities are not just arresting individuals; they are actively dismantling the foundational infrastructure that enables modern ransomware and financial fraud campaigns to operate.

Follow us on Google News, LinkedIn, and X for daily cybersecurity updates. Contact us to feature your stories.