INTERPOL's First MENA Cybercrime Operation Found a Phishing Service That Ran for a Decade While the Threat Feeds Showed Almost Nothing

INTERPOL described Operation Ramz as the first cybercrime operation of its scale coordinated by the organization in the MENA region; the arrest total, 201 people across 13 countries, received the attention it was designed to receive. Three other numbers carry more analytical weight: a phishing service that ran without visible disruption for nearly ten years before a single server was seized; a region where eight of the thirteen targeted countries register no presence at all in the threat-indicator feeds most organizations rely on for real-time awareness; and fifteen workers found at keyboards in Jordan who turned out to be trafficking victims rather than willing participants. They describe the same situation at three different depths.

What Ramz Was

INTERPOL coordinated the sweep across thirteen MENA countries with support from national law enforcement agencies, private threat-intelligence firms, the Qatar Ministry of Interior and the CyberSouth+ joint project, funded by the European Union and Council of Europe. The operation ran from October 2025 to 28 February 2026 and was announced publicly on 18 May 2026, covering Algeria, Bahrain, Egypt, Iraq, Jordan, Lebanon, Libya, Morocco, Oman, Palestine, Qatar, Tunisia and the UAE.

INTERPOL described it in careful language as focused on neutralizing phishing and malware threats, as well as tackling cyber scams that inflict severe cost to the region. That framing is accurate without being complete.

The operation was not organized around arresting individual scammers. It was built around mapping the underlying machinery, identifying actors across jurisdictions, distributing intelligence packages and giving each participating country enough actionable information to raid, seize, disable or investigate. Cybercrime enforcement has historically struggled with fragmentation: the victims sit in one jurisdiction, the server in another, the money mule in a third, the developer in a fourth; if each jurisdiction sees only its own slice the criminal apparatus survives the pressure applied to any single node. Ramz was designed to collapse some of that distance.

Nearly 8,000 intelligence records disseminated across thirteen participating governments is the mechanism that makes the arrest total legible. The arrests are the visible output; the intelligence packages are what could make the next round harder to evade.

The declared targets were phishing campaigns, malware distribution and cyber-enabled financial fraud. What Ramz actually surfaced is how those categories now stack onto one another: phishing kits creating the access layer, compromised machines and commandeered servers creating the hosting layer, fake investment platforms creating the monetization layer and, in at least one disclosed case, trafficked workers supplying the labor layer. These are not separate offenses sitting in the same jurisdiction; they are a production system.

What They Found

The Jordan disclosure is the most structurally significant finding in the public record.

Jordanian police tracked a computer being used to run investment fraud through what presented as a legitimate trading platform: victims were persuaded to deposit funds, then the platform closed once the money had been collected. Fake trading platforms, fake crypto dashboards and fake investment portals have become standard features of the contemporary fraud economy, so that portion of the story carried no surprises.

The raid added something else entirely.

The fifteen people operating the scam were not treated as ordinary cybercriminals. Investigators found they were victims of human trafficking, recruited from Asia under false employment promises; their passports were confiscated on arrival and they were forced or coerced into running the deception. Two suspected organizers were arrested.

That finding connects MENA cyber fraud to the fraud-compound model already documented extensively across Southeast Asia, particularly in Myanmar, Cambodia and Laos, where organized crime supplies the coercion layer while cybercrime operators supply the scripts, the platforms and the technical toolkit. The Jordan case suggests a regional variant of the same arrangement; sitting with what that implies for investigators is worthwhile: a cybercrime raid can simultaneously be a trafficking intervention, the victim count extends beyond the people who lost money to include the people forced to lose their freedom and the assumption that everyone found at a keyboard is a voluntary actor may produce arrests that misidentify coerced workers as perpetrators.

Algeria provided the second major signal. Authorities dismantled a phishing-as-a-service setup, seized a server, computers, a mobile phone and hard drives containing phishing software and scripts, then arrested one suspect. INTERPOL did not name the service in its 18 May release; Group-IB later identified it as SniperDz, addressed in the section below.

Qatar's findings added another dimension: investigators identified compromised devices whose owners were themselves unaware their machines were being used to spread malware; the systems were secured and the owners notified. Oman showed a related ambiguity, with a server located in a private residence, legitimately owned but infected with malware and carrying critical vulnerabilities, disabled and its data secured. Morocco yielded computers, smartphones and external hard drives containing banking data and phishing software, with three individuals entering judicial proceedings.

Taken together, the country findings show a region dealing with every layer of a full threat stack: compromised endpoints, residential servers turned into staging nodes, phishing kits, fake investment platforms and trafficking-linked fraud cells sharing the same enforcement sweep.

The Signal Void

Before any of this became public, the question of how visible MENA cybercrime infrastructure was to external analysts had a fairly clear answer in the data.

The Cloud Analyst runs the thirteen Operation Ramz countries against its ASN atlas, which tracks close to 118,550 autonomous systems representing effectively the full routed address space, cross-referencing against the threat-indicator feeds the atlas ingests, carrying 25,717 indicators drawn from URLhaus and abuse.ch and spanning September 2021 through May 2026. What the query returns is a sharp disparity between network presence and traceable signal.

The thirteen countries together account for 1,008 autonomous systems, roughly 0.85 percent of the global total. Against those 25,717 threat-feed entries, only 43 can be attributed to ASNs registered in those countries, representing 0.17 percent. The region carries five times more of the world's routed address space than it contributes to public threat telemetry; eight of the thirteen countries register no presence at all.

Algeria is the outlier. With 21 autonomous systems it is the smallest registered routing presence in the group, yet it accounts for 19 of the region's 43 threat-feed entries, every one classified as malware_download rather than botnet_cc or any command-and-control category. Algeria is where Ramz dismantled SniperDz. The concentration of delivery-type signals in the country with the smallest network footprint, all pointing to active malware staging rather than persistent connections, is consistent with a kit distribution service pushing content outward to operators in other jurisdictions rather than maintaining long-lived infrastructure of its own.

The United Arab Emirates presents a different signature: of its 10 entries, 6 are classified as botnet_cc, indicating command-and-control traffic rather than outbound delivery. The distinction separates systems being directed from systems pushing outward, which is the telemetry signature of a fraud operation maintaining persistent victim-side connections rather than a one-direction distribution service.

What this tells The Cloud Analyst is not that the MENA region lacks cybercrime activity; the evidence from Ramz itself refutes that conclusion. What it shows is that a substantial share of that activity does not surface in the feeds most security teams use to build exposure awareness, a condition The Cloud Analyst calls the Signal Void: a network presence large enough to sustain a decade-long criminal service that produces almost no traceable signal in the public telemetry where detection would ordinarily begin.

The Signal Void does not explain Operation Ramz by itself. The sweep depended on INTERPOL coordination, private-sector intelligence from Group-IB and four other firms and bilateral cooperation between national law enforcement agencies; none of that work originated from scanning public indicator feeds. The observation is more specific: the public feeds would not have told you to look. A service like SniperDz, distributing templates through Telegram and Facebook to low-skill operators who carried the exposure outward into other jurisdictions, could accumulate 45,000 victim records and run for a decade while the region where its servers sat contributed a fraction of a percent to the global threat signal. The 53 servers seized in Ramz were never going to appear on a Spamhaus drop list.

SniperDz Was the Lead

The strangest element of INTERPOL's 18 May release is what it did not name.

SniperDz was not a small phishing panel assembled for a quick campaign. According to Group-IB reporting, it had operated for nearly ten years, distributing kits through Telegram and Facebook, offering roughly 80 ready-made phishing templates targeting around 30 platforms including PayPal, Facebook, Instagram, Netflix and Steam, with its delivery apparatus tied to more than 20,000 domains. By 2016, the service had already collected more than 45,000 victim records; that was a snapshot from a decade before the takedown, not the lifetime total.

INTERPOL may have had procedural reasons for the omission; agencies often withhold specific identifiers before proceedings advance or before partner disclosures are ready. From a purely analytical standpoint, though, the decade-long PhaaS story is the lead.

Phishing-as-a-service changes the threat landscape for a specific reason: it decouples the technical competence required to run a phishing campaign from the ability to execute one. A user taking a SniperDz template does not need to build a kit, design a credential-capture page or understand how exfiltration works at the network level; they take a template, launch a campaign and feed stolen records into a theft economy that processes them independently. This is what industrialized cybercrime looks like at the supply-chain level: not the most technically sophisticated offering in the ecosystem but the most accessible; accessibility at scale does more cumulative damage than sophistication in isolation ever could.

The 45,000-plus records collected by 2016 should be read carefully as an EARLY datapoint. If that volume was already observable before the takedown, the total downstream harm across the service's full operational life is almost certainly substantially larger than any publicly disclosed figure suggests. A service running for a decade does not produce decade-small harm; the compounding happens in the downstream misuse of those credential records, in account takeovers, in financial theft and in the secondary markets that trade stolen data long after the original capture event.

The 53 servers seized in Ramz sounds like an infrastructure story. SniperDz is the real infrastructure story.

The Private Intelligence Layer

Ramz also demonstrates how cyber enforcement is being reorganized around private-sector intelligence in ways that raise genuine structural questions the sweep itself does not resolve.

INTERPOL listed five private-sector partners: Group-IB, Kaspersky, the Shadowserver Foundation, Team Cymru and TrendAI. Group-IB provided the most detailed public account of its contribution, delivering intelligence on more than 5,000 compromised accounts including accounts associated with government infrastructure, mapping active phishing apparatus and identifying two distinct actor clusters: one involved in creating and distributing phishing resources, another in selling or disseminating stolen credential data.

That is not peripheral support. It is targeting intelligence, the kind of actor-cluster mapping and infrastructure enumeration that determines which raids happen and which do not.

The arrangement reflects how capability has settled between the public and private sectors. Law enforcement provides legal authority, international coordination and the power to arrest, seize or compel. Private firms provide the visibility: telemetry that spans jurisdictions, credential monitoring, malicious-domain tracking, botnet observation and dark-web market coverage that no single national police agency could sustain independently. A police force may see the local victim; a threat-intelligence firm may see the entire campaign.

The tradeoff is accountability. When private firms supply the operational map, they also influence what gets prioritized; that influence is structural: which infrastructure gets enumerated, which actor clusters get surfaced, which campaigns get escalated and which victims appear in the resulting picture because their data happens to fall within commercial telemetry. None of that makes the arrangement wrong. It makes it consequential in ways worth tracking. The private sector is no longer simply cleaning up after cybercrime; in an operation like Ramz, it is embedded in the enforcement architecture before any arrest is made.

The Trafficking Signal

The Jordan finding will receive less attention than it deserves in standard infosec coverage; the reason for that is worth naming directly.

Most security reporting defaults to tools, malware families, domains, servers and TTPs. That vocabulary is precise and useful for a specific set of problems, but it tends to describe the automated layer of an operation while leaving the human labor layer invisible. A fake investment platform is not only software; it is also a workplace. Someone is sending messages, someone is following a script to escalate when a target hesitates, someone is maintaining the illusion of a support desk or account manager. In legitimate businesses those roles would be called sales, support and customer success. In a fraud compound, they become coerced labor.

The Jordan case suggests the MENA region is not only a target geography or a hosting geography. It may be consolidating as a node in the forced-labor fraud economy: the same model that cross-border trafficking networks have built across Southeast Asia, now appearing clearly enough inside a major INTERPOL operation to generate a formal trafficking referral. That does not mean every fraud crew in the region uses trafficked workers; it means the arrangement has established itself firmly enough to surface under serious investigative scrutiny.

That should change the enforcement lens in a practical way. When investigators raid an online fraud cell, they cannot treat keyboard presence as sufficient evidence of voluntary participation. Some of the people found at those keyboards may be victims; some may be simultaneously conducting fraud and subject to coercive control. Distinguishing those situations complicates prosecution timelines, but it makes the underlying investigation more accurate.

The fifteen trafficked workers in Jordan were not the organizers; the two alleged organizers were arrested. That distinction is not a footnote.

Ramz in the 2026 Context

Ramz was not an isolated event. It was the third major INTERPOL cybercrime sweep concluded in 2026.

Operation Red Card 2.0, announced in February 2026, led to 651 arrests across 16 African countries, focused on investment fraud and mobile banking scams. Operation Synergia III, announced in March 2026, involved 45,000 malicious IPs sinkholed, 212 devices or servers seized and 94 arrests across 72 countries. Operation Ramz followed in May 2026, with 201 arrests across the thirteen MENA countries.

The cadence of three operations spread across the first five months of the year is itself informative. INTERPOL is not simply reacting to individual cases; it is building a campaign posture around cybercrime, with regional operations, shared intelligence packages, public-private partnerships and infrastructure disruption becoming the operational template. The old framing for this kind of work was whack-a-mole: one network taken down as three others spin up. The newer approach looks more like periodic pressure campaigns against entire criminal ecosystems, applying coordinated force across multiple jurisdictions in a compressed window rather than allowing each country to proceed at its individual pace.

The open questions are what happens between those campaigns. Do the phishing kits reappear under new branding? Do the same operators rebuild in adjacent jurisdictions where enforcement coordination is weaker? Do identified suspects get arrested in follow-on actions or simply relocate? Do seized servers meaningfully reduce capacity over time or only interrupt it? Do trafficked workers reach protection after a raid or get absorbed into another coercive network before they can be properly identified as victims?

Ramz does not answer those questions. Neither did Red Card 2.0 or Synergia III. The questions are structural; they are the reason milestones like this one deserve analysis beyond the arrest count.

What Ramz Really Tells Us

Operation Ramz is significant for what it reveals about the current state of MENA cybercrime at a specific moment in 2026 and for what the numbers underneath the press release indicate about how that ecosystem is organized.

The public record shows phishing-as-a-service infrastructure that survived undetected in the public feeds for nearly a decade; fake trading platforms linked to forced labor; compromised devices whose owners had no awareness of the compromise; vulnerable private servers absorbed into criminal activity; banking data, phishing software and malware distribution sharing the same enforcement sweep.

The Atlas data adds a layer to that picture: the region itself represents a Signal Void in global threat telemetry, producing a fraction of the indicators its network footprint would predict, which is part of why a service like SniperDz could run for ten years at a scale that generated 45,000 victim records as early as 2016 without generating sustained public visibility. The criminals were operating in a region where the usual early-warning systems were not listening.

The official story is 201 arrests in a first-of-its-kind MENA cybercrime operation. The deeper story is that cybercrime has become a layered service economy, with technical tiers, financial tiers, geographic tiers and human tiers, each providing something the others depend on. Ramz disrupted part of that economy; it did not demonstrate the economy is solved. A phishing service spanning ten years can be dismantled while the demand for accessible phishing infrastructure remains entirely intact; a fake trading platform can be raided while the fraud-compound model continues expanding globally; a trafficking-linked fraud cell can be surfaced while the labor pipeline that supplies it operates under other names in other locations.

Ramz is a milestone; milestones are not endpoints. This one marks something specific: the MENA region is now visibly inside the coordinated global enforcement map for cybercrime, treated not as a side note but as a full theater of operations.

The structure underneath that fact is what makes it significant.

Methodology and Sources

Network data in this analysis comes from the RIPE NCC registration database, PeeringDB (CC BY 4.0) and the CAIDA AS-relationship and AS-organization datasets, held in The Cloud Analyst's ASN atlas at the time of query. The atlas snapshot covers 118,550 autonomous systems across 249 countries and territories. The thirteen countries covered by Operation Ramz account for 1,008 ASNs in that snapshot: Iraq (211), Lebanon (187), UAE (175), Egypt (109), Palestine (67), Jordan (61), Morocco (34), Libya (33), Tunisia (31), Qatar (28), Bahrain (27), Oman (24) and Algeria (21).

Threat-indicator data comes from the URLhaus and abuse.ch feeds ingested by the same pipeline, spanning September 2021 through May 2026 and carrying 25,717 indicators at the time of query. Indicators are attributed to countries via ASN registration; indicators where the hosting ASN carries no registered country code are excluded from the per-country totals. The 43 indicators attributed to the thirteen Ramz countries cover five of the thirteen: Algeria (19, all malware_download), United Arab Emirates (10, comprising 6 botnet_cc and 4 malware_download), Iraq (6, comprising 5 malware_download and 1 botnet_cc), Morocco (6, all malware_download) and Palestine (2, all botnet_cc). Bahrain, Egypt, Jordan, Lebanon, Libya, Oman, Qatar and Tunisia each returned zero entries against the same query.

The Signal Void calculation, the observation that the region holds 0.85 percent of global ASNs and contributes 0.17 percent of tracked indicators, derives directly from those figures: 1,008 of 118,550 and 43 of 25,717. The disparity is reported to illustrate underrepresentation in public telemetry relative to network footprint; it is not a measure of criminality, since the absence of indicators reflects the limits of public feed coverage as much as it reflects actual activity levels.

Operational and arrest figures come from INTERPOL's official 18 May 2026 public release. The identification of SniperDz as the Algeria PhaaS service is from Group-IB's subsequent disclosure; INTERPOL's own release did not name it. SniperDz operational details, including the ten-year lifespan, 80 phishing templates, 30 targeted platforms and 20,000-plus associated domains, come from Group-IB's public reporting. The 45,000 victim records figure refers to records collected by 2016, not to the service's lifetime total. Context on Operation Red Card 2.0 and Operation Synergia III is from INTERPOL's respective public announcements. If you have primary-source corrections, contact steve@higashi.edu.