Group-IB Supports INTERPOL's Operation Synergia Against Ransomware and Phishing in Over 50 Countries
Group-IB flagged 500+ phishing IPs and 1,900+ malware IPs for INTERPOL's Operation Synergia, which led to 31 arrests and hundreds of C2 server takedowns.
Cybersecurity company Group-IB contributed to Synergia, a worldwide law enforcement operation led by INTERPOL that targeted the rise in phishing, banking malware and ransomware attacks across more than 50 countries. Running from September to November 2023, the operation ended with 31 people arrested, 70 more suspects identified and hundreds of command-and-control (C2) servers taken offline.
Group-IB's part was to find the infrastructure. Its team pinpointed over 500 IP addresses hosting phishing resources and upwards of 1,900 IP addresses tied to ransomware, Trojans and banking malware, and passed the findings to the task force so that coordinated action could follow.
Sixty agencies, three months
INTERPOL launched the three-month operation because transnational cybercrime has been growing, escalating and becoming more professional, and because new threats call for a coordinated response. It involved 60 law enforcement agencies from more than 50 INTERPOL member countries, along with INTERPOL's Gateway Partners from the private sector. Officers searched homes and seized servers and electronic devices. So far 70% of the C2 servers identified have been shut down, and the rest are still being investigated.
The operation reached Asia-Pacific, Europe, the Middle East and Africa, among other regions. Group-IB's Threat Intelligence and High-Tech Crime Investigation teams gathered and shared data on the phishing sites and on the addresses used by ransomware, Trojan and other malware operators. The malicious resources were hosted in over 50 countries, Australia, Canada, Hong Kong and Singapore among them, and the attackers' infrastructure was spread across more than 200 web hosting providers worldwide.
Takedowns by region
Police in Hong Kong dismantled 153 servers and police in Singapore 86. Europe accounted for most of the C2 servers taken down, and 26 people were arrested there. In Africa, South Sudan and Zimbabwe recorded the largest number of takedowns, which led to four arrests. Kuwait worked with internet service providers to identify victims, carry out field investigations and give technical advice on limiting the damage.
Bernardo Pillot, Assistant Director to INTERPOL's Cybercrime Directorate, said the outcome came from the combined work of many countries and partners and reflected a firm commitment to protecting the digital space. Taking apart the infrastructure behind phishing, banking malware and ransomware, he said, brings a safer and more secure online experience for everyone a step closer.
Dmitry Volkov, Group-IB's CEO and co-founder, said the operation showed that cooperation between global law enforcement, national cyber police and the private sector is essential. In his words, the partners "forge a collective front", exchanging cyber intelligence and best practice, and the approach shows how much collaboration and effective data sharing do to reduce the worldwide impact of cybercrime.