Group-IB, a global cybersecurity leader headquartered in Singapore, has made a key contribution to the INTERPOL-led Africa Cyber Surge II operation, a major joint initiative between international and national law enforcement agencies and private sector cybersecurity companies to prevent, mitigate, and disrupt threat actors on the African continent. The Africa Cyber Surge II operation, which spanned 25 African countries, resulted in the arrests of 14 suspected cybercriminals and the identification of more than 20,000 suspicious cyber networks linked to financial losses amounting to more than USD $40 million.
The Africa Cyber Surge II operation was launched in April 2023 and was carried out with funding by the UK Foreign Commonwealth and Development Office, the German Federal Foreign Office and the Council of Europe. This multinational, streamlined crime-fighting initiative brought together INTERPOL, AFRIPOL, Group-IB, and Uppsala Security to provide on-the-ground operational support and share of actionable intelligence on cyber extortion, phishing, business email compromise, and online scams. This intelligence was subsequently shared with national law enforcement agencies on the African continent, leading to the arrest of 14 suspects in countries such as Cameroon, Nigeria, and Mauritius, and the takedown of hundreds of malicious IP addresses and malware hosters. Additionally, the educational track of this operation saw parties share best practices on how to combat the surge in digital insecurity and growing cyber threats in the region.
INTERPOL, AFRIPOL and private sector partners Group-IB and Uppsala Security provided on-the-ground operational support, sharing actionable intelligence leveraged throughout the operation.
Operational highlights
- In Cameroon, acting on a tip-off from Côte d’Ivoire, three suspects were arrested in relation to an online scam involving the fraudulent sale of works of art worth USD 850,000.
- Authorities in Nigeria arrested a suspect accused of defrauding a Gambian victim.
- Police in Mauritius arrested two money mules linked to scams initiated through messaging platforms.
- In Gambia, proactive measures and strong partnerships led to the take down of 185 Internet Protocols (IP) connected to malicious activities.
- Two Darknet sites have been taken down following actions by Cameroonian authorities.
- In Kenya, authorities took down 615 malware hosters.
Some 150 INTERPOL analytical reports providing intelligence and insight on cyber threats targeting specific countries were distributed to participating countries for investigative and disruptive actions during the operation.
Developed by INTERPOL based on intelligence shared by private partners, the reports contained information on:
- 3,786 malicious command and control servers
- 14,134 victim IPs linked to data stealer cases
- 1,415 phishing links and domains
- 939 scam IPs
- More than 400 other malicious URLs, IPs and botnets
Group-IB, a long-standing private sector partner of INTERPOL, collected and shared at the request of INTERPOL more than 1,000 indicators drawn from the company’s sector-leading Threat Intelligence related to malicious infrastructure across Africa. The data contained domains, URLs, and server IP addresses used in phishing and malware attacks. INTERPOL member countries in Africa leveraged this information in several takedown operations.
Africa Cyber Surge II also had knowledge sharing at its core. During operational activities held in Tanzania In June, Group-IB’s Deputy Head of APAC High-Tech Crime Investigation Department, Kristina Ivanova, shared expertise on techniques to tackle business email compromise scams, phishing and online fraud, and also contributed to a panel discussion on the importance of public-private sector partnerships in tackling cybercrime. Group-IB experts also assisted national law enforcement agencies on the African continent via a series of practical workshops dedicated to the analysis of real cybercrime cases.
Figure 1. Group-IB’s Kristina Ivanova participates in panel discussion as part of Africa Cyber Surge II’s in-person event in Dar es Salam, Tanzania.
“Group-IB is proud of its contribution to fighting against cybercrime in Africa, and we do this in order to protect organizations and citizens across the whole globe against cybercrime through our intelligence-driven technology and agile expertise. The Africa Cyber Surge II is yet another milestone with regards to cooperation between international law enforcement, national agencies, and private sector cybersecurity companies. Collaboration and intelligence sharing should be at the heart of cybersecurity operations, and Group-IB stands ready to make a further contribution to this end, in line with our core strategic mission of fighting against cybercrime in all its forms.”
CEO at Group-IB
“The Africa Cyber Surge II operation has led to the strengthening of cybercrime departments in member countries as well as the solidification of partnerships with crucial stakeholders, such as computer emergency response teams and Internet service providers. This will further contribute to reducing the global impact of cybercrime and protecting communities in the region.”
INTERPOL Secretary General
“As digital systems, Information Communication Technologies and Artificial Intelligence grow in prominence, it is urgent that public and private actors work hand in hand to prevent these technologies from being exploited by cybercriminals. Coordinated operations such as Cyber Surge are necessary to disrupt criminal networks and build individual, organizational and society-wide levels of protection.”
AFRIPOL’s Acting Executive Director
This most recent initiative follows in the wake of the highly successful Africa Cyber Surge operation, launched in July 2022, which was aimed at identifying cybercriminals and compromised infrastructure in Africa. During this four-month operation, Group-IB provided key cyber threat intelligence that aided cooperation between INTERPOL’s Cybercrime Directorate, ISPA, AFRIPOL, and INTERPOL’s African member states. Some of the operation’s highlights included the arrest of 10 suspects linked to fraud and scams amounting to $800,000 in financial damages, and the takedown of more than 200,000 pieces of malicious infrastructure.
Group-IB, which has a zero-tolerance policy to cybercrime, has been an official private sector partner of INTERPOL since 2017, and the company has participated in multiple crime fighting initiatives on the Africa continent, including Falcon I and II, Delilah, and Lyrebird. In July 2023, Group-IB played a key role in the INTERPOL-led Operation Nervone, an initiative aimed at disrupting the activities of the notorious cybercriminal group dubbed OPERA1ER by Group-IB (also known as NXSMS, DESKTOP-Group, and Common Raven). This joint operation was launched under the guises of the African Joint Operation against Cybercrime (AFJOC) and the INTERPOL Support Programme for the African Union (ISPA), in conjunction with AFRIPOL, the Direction de L’information et des Traces Technologiques (DITT), Group-IB and the Orange CERT Coordination Center (Orange-CERT-CC) led to the arrest of a suspected leader of the cybercrime syndicate in Côte d’Ivoire.
