Group-IB provided threat intelligence on phishing infrastructure and malicious servers used by cybercriminal networks. The international operation, conducted between July 2025  and January 2026, involved law enforcement agencies from 72 countries and territories, resulting in the arrest of 94 people — with another 110 individuals still under investigation — the takedown of more than 45,000 malicious IP addresses and servers, and the seizure of 212 electronic devices and servers linked to cybercriminal activity.

Leveraging Group-IB’s investigative intelligence, law enforcement in 14 countries arrested 260 suspects and seized 1,235 devices linked to 81 cybercriminal infrastructures behind romance scams and sextortion schemes that defrauded 1,463 victims of nearly $2.8 million.

Group-IB provided crucial threat intelligence and training for Operation Serengeti 2.0, sharing insights on cryptocurrency scams, business email compromise (BEC) infrastructure, and malicious networks. The operation led to 1,209 arrests across Africa, the dismantling of 11,432 malicious networks, and recovery of US$97.4 million, protecting nearly 88,000 victims. Highlights included Angola shutting down 25 illegal crypto-mining centers worth over US$37 million, Zambia disrupting a US$300 million investment scam, and Côte d'Ivoire stopping a US$1.6 million inheritance scam.

Operation Secure dismantled a cybercriminal network using infostealer malware such as Lumma, Risepro, and META Stealer, which compromised data of more than 216,000 potential victims. The operation led to 32 arrests, the seizure of 41 servers holding over 100GB of data, and the takedown of over 20,000 malicious IPs and domains.

Group-IB shared critical threat intelligence with INTERPOL to crack down on banking, investment, and messaging scams in Africa. The operation resulted in the arrest of 306 cybercriminals and the dismantling of criminal networks responsible for scams targeting over 5,000 victims, including mobile banking fraud, investment scams, and malicious messaging app schemes. 

Group-IB’s experts participated in a global, INTERPOL-led operation targeting the notorious phishing-as-a-service platform, 16shop. The operation dismantled the platform's infrastructure, which had been used to deploy phishing kits targeting Apple, PayPal, and Amazon users.

The four-month Africa Cyber Surge II operation was launched in April 2023 and focused on identifying cybercriminals and compromised infrastructure. INTERPOL, AFRIPOL, and private sector partners (including Group-IB) provided on-the-ground operational support and shared actionable intelligence leveraged throughout the operation, resulting in the arrests of 14 suspected cybercriminals. The initiative also identified more than 20,000 suspicious cyber networks across the African continent linked to significant financial losses.

Operation Delilah was the third in a series of law-enforcement actions to identify and arrest the suspected leader of the phishing and Business Email Compromise (BEC) syndicate. Nigerian law enforcement arrested the suspected leader in Nigeria. This arrest concluded a year-long international effort led by INTERPOL’s cybercrime division, with support from Group-IB, Palo Alto Networks, and Trend Micro. It highlights the effectiveness of global cooperation in combating cybercrime.

Group-IB supported INTERPOL in disrupting a prolific cybercriminal’s activities - codenamed Lyrebird. This effort led to the identification and apprehension of "Dr. Hex," a prolific Moroccan threat actor responsible for multiple attacks on French telecommunications companies, major banks, and MNCs.

INTERPOL and Group-IB's Cyber Investigation team disrupted a prolific Nigerian cybercrime group. Group-IB identified the gang's use of 26 different malware programs, including AgentTesla and Remcos, to infiltrate organizations in over 150 countries, leading to the arrest of three key suspects.

Group-IB Threat Intelligence specialists provided digital forensics and threat intelligence to the INTERPOL ASEAN Desk to dismantle the GetBilling JS-sniffer family. The operation led to the arrest of suspects in Indonesia who had infected nearly 200 e-commerce websites to steal customer payment and personal data.

Group-IB played a pivotal role in Operation Nervone, a multinational law enforcement effort led by INTERPOL and AFRIPOL, among others, to dismantle OPERA1ER, a cybercriminal syndicate behind a series of financial fraud schemes. Active between 2018 and 2022, the French-speaking collective orchestrated more than 30 attacks targeting banks, financial services, and telecom companies, exploiting vulnerabilities in digital banking and payment systems.