Global INTERPOL Sweep Dismantles Over 10,000 Cybercrime Networks, Seizes $105 Million

INTERPOL revealed Thursday that a synchronized law‑enforcement operation has taken down 10,909 malicious online networks, seized more than $105 million in illicit proceeds and led to the arrest of 1,462 individuals in 21 countries.

The effort, known internally as Operation [Redacted] and coordinated through the organization’s Global Cybercrime Directorate, involved agencies ranging from national police forces to specialized cyber units. Investigators traced digital footprints across multiple jurisdictions, culminating in simultaneous raids and seizures worldwide.

INTERPOL has increasingly focused on transnational cybercrime since the early 2010s, when ransomware and business‑email‑compromise schemes began generating multimillion‑dollar profits. Prior operations, such as the 2021 “Operation Disruptor,” targeted similar infrastructure, but the current sweep marks the largest disruption of illicit networks on record.

Authorities say the arrested suspects were linked to a variety of illegal activities, including ransomware extortion, money‑laundering through cryptocurrency mixers, and the distribution of malware‑as‑a‑service platforms. While individual identities were not disclosed, the breadth of participation underscores how criminal enterprises rely on a globally distributed workforce.

Financially, the recovery of over $105 million represents a rare seizure of proceeds that were often quickly moved through layered crypto wallets and offshore accounts. Disrupting more than ten thousand hostile networks is expected to hinder the operational capacity of ransomware gangs and related fraud groups for months, if not years.

Law‑enforcement officials emphasized that the operation is only a step in a longer campaign. Ongoing investigations will aim to prosecute the arrested individuals, dismantle remaining command‑and‑control servers, and strengthen international legal frameworks for rapid data sharing. The success highlights the importance of coordinated multilateral action against a threat that knows no borders.

Victims of the takedown, ranging from small businesses to critical infrastructure operators, have been notified that compromised credentials and ransomware decryption keys are being shared with them to aid recovery. The operation also prompted a renewed call for private‑sector partners to adopt stronger cybersecurity hygiene and report suspicious activity promptly.