Category: Intelligence

Source: Interpol (news and events)

Buenos Aires, Argentina – The evolving digital landscape in the Americas has increased the challenges and vulnerabilities regarding cybersecurity. Countries across the region now face cybercrime attacks ranging from Business Email Compromise and online scams to ransomware and money laundering.

Cybercrime Threat

Financially motivated groups have not only targeted organizations across Latin America, primarily with ransomware, but they have also broadened the scope of their operations. In the first half of 2020, Latin America for example recorded the world’s highest cyber-attack rates, with nearly three times more attacks via mobile browsers than the global average.  

For example, Costa Rica became the victim of large-scale ransomware attacks initiated by a group called Conti in April 2022. Starting in the Costa Rican ministry of finance, the cyber-assault ultimately involved 27 different ministries in a series of interlinked attacks. Conti’s action left parts of Costa Rica’s digital infrastructure crippled for months, while at the same time disrupting public healthcare and the pay of some public sector workers.

One of Argentina’s largest internet service providers, Telecom Argentina also suffered a major ransomware attack involving around 18,000 computers in 2020. In this incident, hackers demanded a $7.5 million ransom, while employees were prevented from accessing databases and internal VPNs.

In this context, the 7th INTERPOL Americas Working Group on Cybercrime met from 12-16 September in Buenos Aires, Argentina to assess threats and trends across the region. The meeting brought together over 90 participants from 32 member countries, 4 international organizations and 13 public and private entities.

Police cooperation key to fighting cybercrime

Amongst key priorities, the Group discussed the Global Cybercrime strategy 2022 -2025, which will be published later this year. This strategy will develop in-depth understanding of the cybercrime threat and enhance capabilities to prevent, detect, investigate and disrupt cyberattacks.

The Group also discussed the establishment of an Americas Desk for the coordination of operations against cybercrime. This is line with INTERPOL’s global strategy, with other desks previously set up in Africa and the ASEAN regions.

Other topics focused on cyber response initiatives, cryptocurrency investigation, emerging cyber threats in Americas and sharing of investigative information.

“This Working Group is a good opportunity to enhance police cooperation at international and regional level so we can combat cybercrime in a more effective way and make the world a safer place,” said Juan Carlos Hernandez, Chief of the Argentinian Federal Police.

Capacity building in the Americas

Greater reliance on new technologies has paved the way for cybercriminals, as they attack with increased frequency and efficiency.  Lack of sufficient attention to security as well as computer vulnerabilities provide cybercriminals with low-risk, high-reward opportunities for illicit gain.

Faced with this growing threat, INTERPOL carried out a range of activities in Latin America to raise awareness of cybercrime and promote closer regional cooperation. Key activities included training courses on INTERPOL policing capabilities, digital forensics, open-source intelligence, cryptocurrencies and dark web investigations.

Such activities fall under the Cyber Americas Project (funded by Global Affairs Canada) and the Global Action on Cybercrime Extended (GLACY+) project, a joint initiative of the European Union and Council of Europe.

Source: Interpol (news and events)

SINGAPORE: The cybercrime unit of the Nigeria Police Force arrested a 37-year-old Nigerian man in an international operation spanning four continents, coordinated and facilitated by the recently created Africa operations desk within INTERPOL’s cybercrime directorate.

The suspect is alleged to have run a transnational cybercrime syndicate that launched mass phishing campaigns and business email compromise schemes targeting companies and individual victims.

Law enforcement and cybersecurity firms have witnessed the striking increase in many forms of cybercrime in recent years, exploiting the context of COVID-19 and forming what INTERPOL Secretary General Jürgen Stock has called a “parallel pandemic”.

INTERPOL’s Africa desk, called the African Joint Operation against Cybercrime (AFJOC) and funded by the UK Foreign Commonwealth and Development Office, was launched in May 2021 to boost the capacity of 49 African countries to fight cybercrime.

Tracking the suspect’s movements, online and offline

That same month, the police operation, codenamed Delilah, was initiated by an intelligence referral from several INTERPOL partners from the private sector: Group-IB, Palo Alto Networks Unit 42 and Trend Micro.

The intelligence was enriched by analysts within INTERPOL’s Cyber Fusion Centre, which brings together experts from law enforcement and industry to turn information on criminal activities into actionable intelligence. INTERPOL’s AFJOC desk then referred the intelligence to Nigeria and followed up with multiple case coordination meetings supported by law enforcement in Australia, Canada and the United States.

Investigators began to map out and track the alleged malicious online activities of the suspect, thanks to ad hoc support from private sector firm CyberTOOLBELT, as well as tracking his physical movements as he travelled from one country to another. Nigerian law enforcement successfully apprehended the suspect at Murtala Mohammed International Airport in Lagos.

“I hope the results of Operation Delilah will stand as a reminder to cybercriminals across the world that law enforcement will continue to pursue them, and that this arrest will bring comfort to victims of the suspect’s alleged campaigns,” the Assistant Inspector General added.

“This case underlines both the global nature of cybercrime and the commitment required to deliver a successful arrest through a global to regional operational approach in combatting cybercrime,” said Bernardo Pillot, INTERPOL’s Assistant Director, Cybercrime Operations.

“The persistence of national law enforcement agencies, private sector partners and the INTERPOL teams all contributed to this result, analysing vast quantities of data and providing technical and live operational support,” Mr Pillot added. “Cybercrime is a threat that none of our 195 member countries face alone.”

At a time of increased cyber threats targeting businesses and the general public, INTERPOL encourages everyone to follow the safety advice featured in our #JustOneClick, #WashYourCyberHands and other online awareness campaigns, visible on our @INTERPOL_Cyber Twitter page.

Source: Interpol (news and events)

The Nigerian Police Force (NPF) has arrested 11 alleged members of a prolific cybercrime network as part of a national police operation coordinated with INTERPOL.

Arrested by officers of the NPF Cybercrime Police Unit and INTERPOL’s National Central Bureau (NCB) in Nigeria, many of the suspects are thought to be members of ‘SilverTerrier’, a network known for Business Email Compromise (BEC) scams which have harmed thousands of companies globally.

Intelligence-led operation

The ten-day Operation Falcon II (13-22 December) saw 10 NFP officers deployed from the Abuja headquarters to Lagos and Asaba to arrest target suspects identified ahead of time with intelligence provided by INTERPOL.  

Field operations were preceded by an intelligence exchange and analysis phase, where Nigeria used INTERPOL’s secure global police communications network,  I-24/7, to work with police forces across the world also investigating BEC scams linked to Nigeria.

The INTERPOL General Secretariat supported field operations 24/7, forensically extracting and analyzing data contained in the laptops and mobile phones seized by NPF during the arrests.

This preliminary analysis indicates that the suspects’ collective involvement in BEC criminal schemes may be associated with more than 50,000 targets.

One of the arrested suspects was in possession of more than 800,000 potential victim domain credentials on his laptop.

Another suspect had been monitoring conversations between 16 companies and their clients and diverting funds to ‘SilverTerrier’ whenever company transactions were about to be made.

Another individual was suspected of taking part in BEC crime across a wide range of West African countries including Gambia, Ghana and Nigeria.

“By alerting Nigeria to this serious cybercrime threat, INTERPOL enabled me to give the order to hunt down these globally active criminals nationwide, flushing them out no matter where they tried to hide in my country,” said Assistant Inspector General of Police Garba Baba Umar, Head of NCB Abuja and INTERPOL Vice President for Africa.

“The outstanding results of Operation Falcon II have served to disrupt this dangerous cyber gang and protect Nigerian citizens from further attack. I encourage fellow African countries to also work with INTERPOL in ridding our continent of cybercrime to make the cyber world a safer place,” added Mr Umar.

Following the global money trail

With BEC fraud having both a cyber and a financial element, Operation Falcon II saw financial ‘pathfinder countries’ belonging to INTERPOL’s Global Financial Crime Taskforce (IGFCTF) – including Nigeria – work together on cross-border financial investigations linked to the operation.  

The IGFCTF is now coordinating further action against ‘SilverTerrier’ bank accounts and sharing intelligence on the domain credentials of potential victims with member countries to prevent further fraud.

“Operation Falcon II sends a clear message that cybercrime will have serious repercussions for those involved in business email compromise fraud, particularly as we continue our onslaught against the threat actors, identifying and analyzing every cyber trace they leave,” said INTERPOL’s Director of Cybercrime Craig Jones.

“INTERPOL is closing ranks on gangs like ‘SilverTerrier’; as investigations continue to unfold, we are building a very clear picture of how such groups function and corrupt for financial gain. Thanks to Operation Falcon II we know where and whom to target next,” added Mr Jones.

Critical partnerships

Led by INTERPOL’s Cybercrime Directorate in Singapore, Operation Falcon II was a cooperative effort involving IGFCTF, Nigerian law enforcement agencies, a range of INTERPOL expert teams and vital private partners Palo Alto Networks Unit 42 and Group-IB’s APAC Cyber Investigations Team.

Through INTERPOL’s Gateway initiative, Palo Alto Networks Unit 42 and Group-IB have contributed to investigations by sharing information on ‘SilverTerrier’ threat actors, and analyzing data to situate the group’s structure within the broader organized crime syndicate.  They also provided key technical expertise consultancy to support the INTERPOL teams.

Gateway boosts law enforcement and private industry partnerships to generate threat data from multiple sources and enable police authorities to prevent and investigate attacks in a timely manner.

The operation was developed as part of efforts to support joint operations in Africa with funding by the Foreign, Commonwealth and Development Office (UK).  INTERPOL extends its thanks for this support.

At a time of increased threat, members of the public, businesses and organizations are reminded to protect themselves from online scams by following the advice featured in INTERPOL’s #JustOneClick, #WashYourCyberHands, #OnlineCrimeIsRealCrime and #BECareful campaigns.

Source: Interpol (news and events)

SEOUL, Korea – A 30-month transcontinental investigation and operation has resulted in arrests and Red Notices for suspects believed to be behind a global malware crime network.

Two Red Notices, which are internationally wanted persons alerts, have been circulated to INTERPOL’s 194 member countries following a request by Korea’s cybercrime investigation division via INTERPOL’s National Central Bureau in Seoul.

The Notices follow the Ukraine arrest of six members of a notorious ransomware family during a global operation coordinated by INTERPOL with Korean, Ukrainian and US law enforcement authorities in June.

The global strike – codenamed Operation Cyclone – follows global police investigations into attacks against Korean companies and US academic institutions by the Cl0p ransomware threat group.

Cl0p malware operators in Ukraine allegedly attacked private and business targets in Korea and the US by blocking access to their computer files and networks, and then demanded extortionate ransoms for restoring access.

The suspects are thought to have facilitated the transfer and cash-out of assets on behalf of the ransomware group whilst also threatening to make sensitive data public if additional payments were not made.

Intelligence-led operation

Operation Cyclone was coordinated from INTERPOL’s Cyber Fusion Centre in Singapore where stakeholders shared intelligence in an interactive and secure environment via INTERPOL’s global network and capabilities.

The resulting intelligence enabled Ukrainian police to search more than 20 houses, businesses and vehicles, confiscate property and computers, and seize USD 185,000 in cash assets, as well as to make the six arrests.

“Despite spiralling global ransomware attacks, this police-private sector coalition saw one of global law enforcement’s first online criminal gang arrests, which sends a powerful message to ransomware criminals, that no matter where they hide in cyberspace, we will pursue them relentlessly,” said INTERPOL’s Director of Cybercrime Craig Jones.

INTERPOL deployed Operation Cyclone with the assistance of information provided by its private partners Trend Micro, CDI, Kaspersky Lab, Palo Alto Networks, Fortinet and Group-IB through INTERPOL’s Gateway project.

Gateway boosts law enforcement and private industry partnerships to generate threat data from multiple sources and enable police authorities to prevent attacks.

Further illustrating the power of private sector cooperation in cybercrime investigations, two Korea-based cyber threat companies – S2W LAB and KFSI – also provided INTERPOL with valuable dark web data analysis throughout the operation.

Operation Cyclone continues to supply evidence that is feeding into further cybercrime investigations and enabling the international police community to disrupt numerous channels used by cybercriminals to launder cryptocurrency.

Significant security threat

The six suspects are believed to be tightly linked to a Russian-language cybercriminal gang known for naming-and-shaming its victims on a Tor leak site, and for moving more than USD 500 million in funds linked to multiple ransomware activities.

Their attacks target key infrastructure, such as transportation and logistics, education, manufacturing, energy, financial, aerospace, telecommunications, healthcare and high-tech sectors worldwide.

If convicted, the six suspects face up to eight years in prison.

Source: Interpol (news and events)

LYON, France – A coordinated international crackdown on human trafficking has led to the identification of 2,070 victims, the arrest of 1,024 suspects and the launch of 465 investigations.

Operation Global Chain, carried out from 8 to 12 June, brought together law enforcement from 59 countries across Africa, the Americas, Asia and Europe in a targeted effort against trafficking networks involved in sexual exploitation, forced labour and criminality, and coerced begging.

The operation, led by authorities in Austria and Romania and co-coordinated by INTERPOL, Europol, Frontex and Ameripol, resulted in 334 arrests for human trafficking offences and 690 for associated crimes.

Coordinated enforcement action

During the five-day operation, police, border authorities and specialized anti-trafficking units conducted checks at border crossings, airports and other transport hubs, as well as locations identified as trafficking hotspots from investigations.

Participating countries exchanged intelligence in real time through INTERPOL’s secure I-24/7 communication network, as well as through Europol and Ameripol channels, enabling cross-checks and coordinated enforcement actions. In support of investigations, INTERPOL issued 17 new Notices, while border checks generated 20 hits against existing Notices.

Two international command centres were set up in Skopje, North Macedonia, and Rio de Janeiro, Brazil, to facilitate operational briefings, analytical support and direct communication between countries.

Victims identified worldwide

While the victims originated from 45 countries across multiple regions, the majority originated from Argentina, Colombia, Venezuela, as well as Moldova and Nepal. Many were trafficked across borders after being deceived, coerced, or targeted because of their vulnerable situations.

Among the cases:

• Brazil’s Federal Police dismantled a transnational network trafficking victims to Cambodia where they were forced into online scamming. Authorities identified 406 victims (83 Brazilians and 323 foreign nationals) and issued two Red Notices and nine Blue Notices targeting wanted suspects and persons of interest.

• In Argentina, Federal Police carried out two raids, rescuing two Bolivian child labour victims exploited in a grocery store and arresting traffickers. Investigations revealed a larger coordinated exploitation network across multiple sites.

• Authorities in Belgium arrested 17 suspects after they dismantled a trafficking network recruiting underage girls via social media. The suspects allegedly held the victims captive, forcing them into prostitution rings across Belgium and France.

The victims identified during Operation Global Chain were referred to national protection and support services.

INTERPOL Secretary General Valdecy Urquiza said:

“Human trafficking remains one of the most profitable and pervasive forms of organized crime worldwide, generating hundreds of billions in illicit revenue every year and causing severe and lasting harm to victims.

“Operation Global Chain reflects our shared commitment to tackle this threat through coordinated, multi-agency action. The results demonstrate what can be achieved when countries work together to disrupt criminal networks and strengthen cooperation across regions. Human traffickers exploit vulnerabilities across borders; our response must be equally global, coordinated and relentless.”

Evolving human trafficking patterns

Operational findings highlighted evolving trafficking routes and methods, illustrating how criminal networks continue to adapt to shifting economic opportunities, migration dynamics and geopolitical developments.

Among the trends identified were the trafficking of Latin American victims for forced labour in Europe, their exploitation in criminal activities in Southeast Asia, and trafficking cases linked to forced engagement in armed conflicts.

Approximately 10 per cent of the victims were minors from the Americas who were subjected to sexual exploitation.

In response to evolving recruitment tactics used by traffickers, authorities in Colombia launched a prevention campaign targeting nationals lured by fraudulent job offers abroad.

By highlighting common trafficking tactics, the campaign aimed to reduce vulnerability and strengthen public awareness of the risks.

Note to editors

Operation Global Chain was conducted under the European Multidisciplinary Platform Against Criminal Threats (EMPACT), with support from international partners and funding initiatives including EL PACCTO 2.0 and INTERPOL’s I-FORCE project.

Participating countries: Albania, Argentina, Austria, Belgium, Belize, Bolivia, Bosnia and Herzegovina, Brazil, Bulgaria, Chile, Colombia, Costa Rica, Croatia, Czechia, Denmark, Dominican Republic, Ecuador, El Salvador, Estonia, Finland, France, Georgia, Germany, Greece, Guatemala, Haiti, Hungary, Iceland, Ireland, Kosovo*, Latvia, Lithuania, Luxembourg, Malta, Moldova, Montenegro, Netherlands, Nigeria, North Macedonia, Norway, Panama, Paraguay, Peru, Poland, Portugal, Romania, Serbia, Slovenia, Slovakia, Spain, Sweden, Switzerland, Thailand, Ukraine, United States, United Kingdom, Uruguay, Venezuela and Viet Nam.

* This designation is without prejudice to positions on status and is in line with UNSCR 1244/1999 and the ICJ Opinion on the Kosovo declaration of independence.

Source: Interpol (news and events)

LYON, France – Two terrorist suspects wanted internationally under Red Notices have been arrested during an international maritime border operation coordinated by INTERPOL.

Another eight investigative leads linked to terrorism were generated during Operation Neptune IV (1 July – 3 September) which targeted terrorist suspects and other criminals involved in serious organized crime travelling via maritime routes between North Africa and Southern Europe.

The intelligence-led operation was supported by an INTERPOL team on the ground, and also targeted criminal networks involved in the drugs trade, firearms trafficking, human trafficking and people smuggling.

Officials at seaports and airports in eight countries – Algeria, Cyprus, France, Italy, Lebanon, Morocco, Spain and Tunisia – carried out more than 2.6 million checks across INTERPOL’s databases for stolen and lost travel documents, nominal data and stolen vehicles via its I-24/7 secure global police communications network.

These checks generated 140 hits, resulting in 14 additional arrests following seizures worth USD 3.6 million, including: 33 kg of cocaine, some 39,400 ecstasy pills, 133 kg of cannabis, and ten stolen cars. Ten firearms were also seized.

The operation also targeted illicit migrant flows, with authorities in France, Italy and Spain arresting suspected human traffickers and people smugglers and intercepting 13 irregular migrants.

With thousands of vehicles and passengers crossing international borders via maritime routes every year, INTERPOL Secretary General Jürgen Stock said that cross-border initiatives such as Neptune demonstrate how concerted law enforcement action can disrupt terrorist threats and criminals on the move.

“We know that the threat landscape continues to evolve and so too must law enforcement responses to terrorism and transnational organized crime,” said Secretary General Stock.

“Cross-border information exchange between law enforcement agencies and partner agencies is vital to ensure frontline border officers have access to the right information at the right time.

“Operation Neptune ensures that we are coordinating law enforcement efforts at a national, regional and global level. It provides a tangible response to security threats by better targeting the illicit movement of goods and people and serious organized crime activities,” added the Secretary General.

Italian authorities in the port of Genoa also seized some EUR 250,000 in undeclared cash, which investigators suspect was part of illicit money flows towards the Middle East and North Africa region as part of terrorist financing.

INTERPOL’s databases currently hold details of more than 87,000 foreign terrorist fighters and some 1.6 million pieces of terrorist-related information.

The role of international cooperation against crime was further highlighted in the operation with experts from Europol, the European Border and Coast Guard Agency (Frontex) and the World Customs Organization also involved in the initiative.