Operation Synergia II: A Global Assault on Cybercrime

In a significant showdown against cybercrime, INTERPOL announced on November 6, 2024, the successful takedown of over 22,000 malicious servers as part of Operation Synergia II. This coordinated global effort spanned several months, from April 1 to August 31, and aimed at dismantling critical infrastructures tied to phishing, ransomware, and information-stealing activities.

The Scale of the Operation

INTERPOL revealed that approximately 30,000 suspicious IP addresses were identified during the operation, with a remarkable 76% being successfully taken down. Among these actions, 59 servers were seized, alongside the confiscation of 43 electronic devices—which included laptops, mobile phones, and hard disks. The sheer volume of targeted infrastructure underscores the scale at which cybercriminals have been operating globally.

Arrests and Ongoing Investigations

As a part of this extensive crackdown, 41 individuals were arrested, while investigations into 65 others are ongoing. The operation also produced notable results on a country-by-country basis:

• Hong Kong: More than 1,037 servers were dismantled.
• Mongolia: One server was seized, and 93 individuals were linked to illegal cyber activities.
• Macau: 291 servers were disrupted.
• Madagascar: Eleven individuals linked to malicious servers were identified, with 11 electronic devices seized.
• Estonia: Over 80GB of data was confiscated.

This impressive array of outcomes illustrates the collaborative efforts of law enforcement agencies across various nations in tackling the pervasive threat of cybercrime.

Collaboration with Private Sector Partners

INTERPOL wasn’t alone in this crucial operation. Organizations such as Group-IB, Kaspersky, Team Cymru, and Trend Micro played significant roles by contributing intelligence and resources. Group-IB reported identifying over 2,500 IP addresses related to 5,000 phishing websites, along with 1,300 IP addresses tied to malware activities spanning 84 countries.

Kaspersky shared critical information concerning botnets and command-and-control servers used in the dissemination of Internet of Things (IoT) malware, significantly bolstering the effectiveness of the operation.

Insights from Team Cymru

David Monnier, chief evangelist at Team Cymru, highlighted how their analytical efforts helped in categorizing malicious infrastructures. The organization used telemetry analysis to map out the extent of cybercriminal networks, without diving into specifics of malware families due to their constantly evolving nature. This strategic focus ensured a comprehensive understanding of malicious nodes, crucial for future prevention efforts.

The First Phase: A Precursor to Synergia II

Operation Synergia II built upon the first phase, which occurred between September and November 2023. This initial effort saw 31 arrests and identified 1,300 suspicious IP addresses and URLs primarily associated with phishing and ransomware attacks.

The collaborative nature of these operations emphasizes the evolving landscape of cyber threats and the necessity of coordinated responses across borders and sectors.

As cybercrime becomes increasingly sophisticated, initiatives like Operation Synergia II serve as a vital reminder of the need for continued vigilance and collaborative action in the global fight against cyber threats.