INTERPOL on Wednesday introduced the dismantling of greater than 20,000 malicious IP addresses or domains which were linked to 69 information-stealing malware variants.
The joint motion, codenamed Operation Safe, happened between January and April 2025, and concerned legislation enforcement businesses from 26 international locations to determine servers, map bodily networks, and execute focused takedowns.
“These coordinated efforts resulted within the takedown of 79 p.c of recognized suspicious IP addresses,” INTERPOL mentioned in an announcement. “Taking part international locations reported the seizure of 41 servers and over 100 GB of information, in addition to the arrest of 32 suspects linked to unlawful cyber actions.”
Vietnamese authorities arrested 18 suspects, and confiscated gadgets, SIM playing cards, enterprise registration paperwork, and cash value $11,500. Additional home raids have led to the arrest of one other 12 individuals in Sri Lanka and two people in Nauru.
The Hong Kong Police, per INTERPOL, recognized 117 command-and-control servers hosted throughout 89 web service suppliers. These servers have been designed to behave as a hub to launch and handle malicious campaigns, akin to phishing, on-line fraud, and social media scams.
International locations concerned in Operation Safe embody Brunei, Cambodia, Fiji, Hong Kong (China), India, Indonesia, Japan, Kazakhstan, Kiribati, Laos, Macau (China), Malaysia, Maldives, Nauru, Nepal, Papua New Guinea, Philippines, Samoa, Singapore, Solomon Islands, South Korea, Sri Lanka, Thailand, Timor-Leste, Tonga, Vanuatu, and Vietnam.
The event comes weeks after a world operation led to the seizure of two,300 domains related to the Lumma Stealer malware.
Data stealers, typically bought on the cybercrime underground on a subscription foundation, are seen as a stepping stone for menace actors to realize unauthorized entry to focus on networks. These malicious applications make it attainable to siphon browser credentials, passwords, cookies, bank card particulars, and cryptocurrency pockets information from contaminated machines.
The stolen info is then monetized within the type of logs on numerous boards, enabling different actors to conduct follow-on assaults, together with ransomware, information breaches, and enterprise e-mail compromise (BEC).
Singapore-headquartered Group-IB, which was one of many personal sector firms that participated within the operation, mentioned it offered mission-critical intelligence associated to person accounts compromised by stealer malware like Lumma, RisePro, and Meta Stealer.
“The compromised credentials and delicate information acquired by cybercriminals by way of infostealer malware typically function preliminary vectors for monetary fraud and ransomware assaults,” mentioned Dmitry Volkov, CEO of Group-IB.
