Cybercrime

3,500 Arrested, $300 Million Seized in International Crackdown on Online Fraud

Authorities in 34 countries have cooperated to dismantle cyber-enabled scams as part of a six-month operation.

Authorities in 34 countries have cooperated to dismantle cyber-enabled scams as part of a six-month operation.

As part of an international effort to tackle online financial fraud, authorities in 34 countries have arrested approximately 3,500 suspects and seized roughly $300 million worth of assets, Interpol announced on Tuesday.

The six-month operation, named HAECHI IV, targeted business email compromise (BEC), ecommerce fraud, investment fraud, voice phishing, money laundering associated with illegal online gambling, romance scams, and online sextortion schemes.

As part of the effort, authorities blocked more than 82,000 bank accounts and seized $199 million in hard currency and approximately $101 million in cryptocurrency. More than 360 virtual asset accounts were frozen.

According to Interpol, roughly 75% of the cases investigated as part of operation HAECHI IV were related to investment fraud, BEC, and ecommerce fraud schemes.

The operation also led to the arrest of a high-profile online gambling criminal who evaded authorities for two years.

“The seizure of $300 million represents a staggering sum and clearly illustrates the incentive behind today’s explosive growth of transnational organized crime. This represents the savings and hard-earned cash of victims. This vast accumulation of unlawful wealth is a serious threat to global security and weakens the economic stability of nations worldwide,” Interpol executive director Stephen Kavanagh said.

Advertisement. Scroll to continue reading.

Also on Tuesday, Europol published its 2023 Internet organized crime threat assessment (PDF) and an accompanying IOCTA spotlight report (PDF), noting that investment fraud and BEC schemes remain the most prolific forms of online financial fraud, while cybercrime markets are booming with stolen data and credentials.

“The central commodity of this illicit economy is stolen data, which is bought for and produced by different cyber-attacks. Affiliates of ransomware programs, fraudsters and hackers seek victim information for gaining access to their systems and bank accounts,” Europol notes.

The report underlines similarities in techniques across different types of cybercriminal activities, as well as the perpetrators’ reliance on cybercrime services such as initial access brokers for ransomware and other malware delivery, counter antivirus services for detection evasion, and VPNs for masking identities. On top of these, there are the internet services providers that turn a blind eye to the illicit operations performed using their infrastructure.

Related: China Crackdown on Cyber Scams in Southeast Asia Nets Thousands but Leaves Networks Intact

Related: Police Looking for Russian Suspects Following DoppelPaymer Ransomware Crackdown

Related: Spain Arrests Hackers in Crackdown on Major Criminal Organization

Related Content

Malware & Threats

The extension amassed over 300,000 installs and a 4.6 rating before Google removed it for stealing data.

Malware & Threats

Initially calling itself BlackFile, the group has expanded operations to the Redact, Pink, Helix, and Falcon brands.

Data Breaches

Hackers recently obtained non-sensitive customer information and other documents from the company.

Cybercrime

Hundreds of C&C servers were disrupted in an operation involving law enforcement and several cybersecurity companies.

Cybercrime

Nathan Austad has been ordered to pay roughly $1.8 million in forfeiture and restitution, and the sentence also includes 3 years of supervised release. 

Malware & Threats

Mistic is used by Woodgnat, an initial access broker working with Qilin, Interlock, Rhysida, Akira, 8Base, and Black Basta.

Cybercrime

26-year-old Abdellah Belmili faces up to 30 years in prison for allegedly operating the marketplaces Market0Day and Spoxy.

Cybercrime

Using a custom sniffer, the threat actor has captured over 110 million credentials since at least February 2026.

Copyright © 2026 SecurityWeek ®, a Wired Business Media Publication. All Rights Reserved.

Exit mobile version