FlagThis

INTERPOL has announced the successful culmination of Operation Secure, a global initiative targeting the infrastructure of information-stealing malware. The operation, which spanned from January to April 2025, involved law enforcement agencies from 26 countries who worked collaboratively to locate servers, map physical networks, and execute targeted takedowns. This coordinated effort resulted in the dismantling of more than 20,000 malicious IP addresses and domains associated with 69 different variants of infostealer malware, significantly disrupting cybercriminal activities worldwide.

Operation Secure also led to the seizure of 41 servers and over 100 GB of data, providing valuable insights into the operations of cybercriminals. A total of 32 suspects were arrested across multiple countries in connection with illegal cyber activities, demonstrating the effectiveness of international cooperation in combating cybercrime. Eighteen arrests occurred in Vietnam, where authorities confiscated devices, SIM cards, business registration documents, and a substantial sum of cash, revealing a scheme to open and sell corporate accounts for illicit purposes.

The operation was further bolstered by the contributions of private sector cybersecurity firms, including Group-IB, Kaspersky, and Trend Micro, who provided critical intelligence and Cyber Activity Reports to assist cyber teams. This collaboration resulted in the takedown of 79% of identified suspicious IP addresses. Hong Kong police played a key role by analyzing over 1,700 pieces of intelligence and identifying 117 command-and-control servers used by cybercriminals to orchestrate phishing schemes, online fraud, and social media scams.

ImgSrc: cyberscoop.com

References :

• www.helpnetsecurity.com: Operation Secure takes down 20,000 malicious IPs and domains.
• The Hacker News: INTERPOL Dismantles 20,000+ Malicious IPs Linked to 69 Malware Variants in Operation Secure
• therecord.media: Interpol said a global operation successfully targeted the infrastructure of infostealer malware.
• cyberinsider.com: INTERPOL Seizes 20,000 Infostealer-Linked Assets, Arrests 32 Operators
• Threats | CyberScoop: Operation Secure targeted malicious IPs, domains and servers used for infostealer operations that claimed more than 216,000 victims.
• hackread.com: Operation Secure: INTERPOL Disrupts 20,000 Infostealer Domains, 32 Arrested
• securityaffairs.com: Operation Secure: INTERPOL dismantles 20,000+ malicious IPs in major cybercrime crackdown
• The Record: Interpol said a global operation successfully targeted the infrastructure of infostealer malware.
• www.cybersecuritydive.com: Global law-enforcement operation targets infostealer malware
• CyberInsider: INTERPOL Seizes 20,000 Infostealer-Linked Assets, Arrests 32 Operators
• cyberscoop.com: Global law enforcement action in Asia nets large infrastructure seizure, 32 arrests
• www.trendmicro.com: Operation Secure: Trend Micro's Threat Intelligence Fuels INTERPOL's Infostealer Infrastructure Takedown
• Tech Monitor: Interpol’s cybercrime operation dismantles over 20,000 malicious domains
• securityonline.info: Interpol & Asian Agencies Dismantle Major Malware Infrastructure: 20,000 Malicious IPs Blocked

Classification:

• HashTags: #Cybersecurity #Infostealer #INTERPOL
• Company: INTERPOL
• Target: Asia-Pacific
• Attacker: INTERPOL
• Product: domains
• Feature: Takedown Operation
• Malware: Infostealer
• Type: Legal
• Severity: Major