INTERPOL operation in the MENA region leads to over 200 arrests

INTERPOL has coordinated a multinational cybercrime operation called Operation Ramz, targeting phishing, malware and online fraud infrastructure across the Middle East and North Africa. The operation led to more than 200 arrests and the seizure of 53 servers.

Investigators identified thousands of victims through analysis of seized infrastructure and cybercriminal data. Multiple regional law enforcement agencies collaborated with private security firms including Kaspersky, Group-IB, Team Cymru and Shadowserver. The operation reflects a growing international focus on dismantling criminal infrastructure and improving cross-border cooperation.

What this means for your business

The practical point is that victims are identified after the fact, from data found on seized servers. Many organisations first learn they were affected when someone else analyses the attacker's systems. That assumes you have logs to check and a channel to receive such information through. Without both, the notification simply goes unhandled.

Berigo recommends

• Ensure there is a known, staffed channel for external security notifications, and that it is published.
• Retain logs long enough to investigate an event several months old.
• Use the occasion to review how you handle notifications about compromised user accounts.
• Identify which of your users are most exposed to phishing, and prioritise training accordingly.

Source

• interpol.int