20,000 dangerous sites taken down in global cybercrime crackdown: All the details

Hacker

A sweeping international crackdown on cybercrime has uncovered a massive underground network of data theft operations, with authorities seizing 41 servers and arresting 32 suspects linked to the deployment of information-stealing malware.

The four-month operation, codenamed Operation Secure, ran from January to April 2025 and involved coordinated action by law enforcement agencies from 26 countries across the Asia-Pacific region. Led by Interpol, the operation targeted the physical infrastructure behind widespread cyberattacks, including malicious IP addresses, command-and-control servers, and underground data markets.

Over 20,000 malicious IP addresses and domains were taken down, many of which were linked to infostealers—malware designed to extract sensitive information from infected devices without detection. These programs can collect browser credentials, passwords, cookies, payment details, and crypto wallet information. Once harvested, the data is often traded on the dark web or used to launch further attacks, including ransomware and large-scale fraud.

Interpol worked closely with cybersecurity firms Group-IB, Kaspersky, and Trend Micro to compile threat intelligence before the operation began. As a result, 79% of flagged IP addresses were neutralised, and over 100 GB of data was recovered.

Among the countries reporting significant results was Vietnam, where police arrested 18 suspects and uncovered a cache of SIM cards, business documents, and cash—evidence of a commercial scheme to open and sell corporate accounts. In Sri Lanka, authorities made 12 arrests following house raids and identified 31 victims of cyber-related fraud.

In Hong Kong, police processed over 1,700 pieces of intelligence from Interpol, tracing 117 servers used to control malicious activity across 89 internet service providers. These servers were central hubs for phishing, social engineering, and scam operations.

The operation also resulted in 216,000 victims and potential victims being alerted, allowing them to take urgent actions such as changing passwords or freezing accounts.

“Operation Secure has proven the value of intelligence sharing in neutralizing cybercriminal infrastructure,” said Neal Jetton, Interpol’s Director of Cybercrime. “This is about stopping harm before it spreads to more individuals and businesses.”

The operation was conducted under the Asia and South Pacific Joint Operations Against Cybercrime (ASPJOC) initiative, demonstrating the growing commitment among nations to confront the escalating threat of global cybercrime.