LOWMalware
Verified
Global

Interpol Operation Synergia II Dismantles 22,000 Malicious Servers Globally

Saturday, February 28, 2026 at 10:00 AM UTC·Source: Interpol

Updated: Sunday, March 1, 2026 at 08:00 AM UTC

Executive Summary

Interpol-led operation takes down 22,000 malicious servers across 100+ countries. 41 arrests made. Focus on phishing, ransomware, and infostealer infrastructure.

Analysis

Interpol Operation Synergia II, conducted between January and March 2026, has resulted in the takedown of 22,000 malicious IP addresses and servers and 41 arrests across 100+ countries. The operation targeted infrastructure supporting phishing campaigns, ransomware operations, and information stealer malware. Key takedowns include bulletproof hosting providers in Eastern Europe and Southeast Asia. Interpol credits improved intelligence sharing with private sector partners including Group-IB, Trend Micro, and Kaspersky.
Source Attribution

Originally published by Interpol on Feb 28, 2026. Verified by: Interpol, Group-IB, Trend Micro.

Related Threats

MEDIUMMalware

Claude Code leak used to push infostealer malware on GitHub

Threat actors are exploiting the recent Claude Code source code leak by using fake GitHub repositories to deliver Vidar information-stealing malware. [...]

BleepingComputer
MEDIUMMalware

Bank Trojan 'Casbaneiro' Worms Through Latin America

Augmented Marauder's multipronged banking-Trojan cyber campaigns are targeting Spanish speakers, evading detection, and replicating rapidly.

Dark Reading
MEDIUMMalware

GitHub Used as Covert Channel in Multi-Stage Malware Campaign

LNK files use GitHub C2, embedded decoders and PowerShell for persistence and data exfiltration

Infosecurity Magazine