The Arrests Were in MENA. The Targets Weren't.

INTERPOL announced this week that a six-month coordinated operation across thirteen countries in the Middle East and North Africa took down 201 cybercriminals, identified 382 more suspects, seized 53 servers, and shared roughly 8,000 pieces of intelligence between participating agencies. Operation Ramz, as it was called, ran from October 2025 to February 2026 and is the largest operation INTERPOL has ever coordinated in the region against cyber-enabled fraud.

The headlines focus on the arrests. The number American business owners should focus on is buried in the press release: 3,867 victims identified. Where those victims actually live is the part nobody is leading with.

Source: INTERPOL News, "201 arrests in first-of-its-kind cybercrime operation in MENA region," May 18, 2026.

Cybercrime is geographic in origin, global in victimology

The criminals INTERPOL just arrested were not stealing from their neighbors. They were running phishing campaigns, malware operations, and scam infrastructure that targeted businesses globally. The same FBI report I cited two weeks ago shows where the money actually went: $20.877 billion in losses across more than a million complaints in 2025, with the average loss per complaint hitting $20,699. That is American money. American businesses. American payroll accounts.

Cybercriminals organize themselves geographically by where the law cannot easily reach them. They organize their targeting by where the dollars are. The MENA region, West Africa, Southeast Asia, and Eastern Europe are not where most cyber losses happen. They are where most cyber losses originate. The losses themselves happen in American AP departments, real estate escrow accounts, and small-business inboxes.

INTERPOL's announcement explicitly named phishing, malware, and "cyber scams that inflict severe cost to the region." But the infrastructure those criminals were running was almost certainly hitting US targets as well. That is the business model. American small businesses are the world's most valuable target market for cyber fraud, full stop. A scam network in Doha or Cairo or Tunis is not designing campaigns to drain a $500 invoice from a local bakery. They are designing campaigns to drain a $187,000 wire from an American manufacturer.

The pattern is not regional

If you read past the geography of Operation Ramz, what gets disrupted is the same playbook the FBI flagged last month in their cargo theft advisory. The same playbook in the 2025 IC3 report. Get into a legitimate inbox. Use that inbox's reputation to issue fraudulent instructions. Move money or goods before anyone notices the request didn't come from the legitimate party. Disappear.

The mechanic does not change with geography. Whether the criminal is sitting in Lagos, Kuala Lumpur, or Bucharest, the playbook is identical. Phishing email arrives. Helper application gets installed. Email account is compromised. Vendor banking instructions get changed. Wire goes out. The geography of the criminal is invisible to the victim.

The math of asymmetry

Operation Ramz identified 3,867 victims for 201 arrests. That is roughly nineteen victims per criminal. The asymmetry is the story. A small team of people can produce thousands of victims because almost every step of the work is automated. Phishing emails are mass-produced. Malware is templated. Bank-account changes are scripted. The only thing the criminals cannot automate is the human verification step they need their victims to skip.

The thing they need from you is a click without a callback. A wire without a phone call. A bank-detail change without a second pair of eyes. That is the entire vulnerability they are exploiting. Everything else on their side is software.

53 servers does not kill the network

Fifty-three servers got seized. That sounds like a lot. It is not. Modern scam networks are built on rented infrastructure. The phishing kits are hosted on commodity cloud servers. The command-and-control for malware sits on bulletproof hosting in jurisdictions that ignore takedown requests. The money-mule coordination happens on encrypted messengers. The fiat off-ramps happen at unregulated exchanges or through layered crypto.

When fifty-three servers go down, the network does not die. It migrates. New domains are registered within hours. New servers are provisioned within days. The same operators are back online before the press release is even published.

This is the part of the story that does not get told. "Wait for law enforcement to catch them" is not a defense plan. Law enforcement is moving as fast as international cooperation allows. The criminals are moving as fast as cloud APIs allow. Those speeds are not the same.

The public-private partnership is the new model

What made Operation Ramz work was not just thirteen national police forces. INTERPOL credited five private-sector intelligence partners by name: Group-IB, Kaspersky, the Shadowserver Foundation, Team Cymru, and TrendAI. The takedowns that succeed are the ones where industry intelligence flows into law enforcement faster than the criminals can rebuild.

This is the model going forward. Public-sector cybercrime enforcement has neither the budget nor the staff to keep up unilaterally. They depend on private threat-intelligence firms, on incident responders, and on the victims themselves to report. Small and mid-sized businesses benefit from this model only when they participate. That means reporting incidents to IC3 even when the loss feels small. It means sharing indicators of compromise with your IT provider. It means not staying silent after a phishing hit because of embarrassment.

The criminals are aggregated, organized, and information-sharing across borders. Defenders are aggregated, organized, and information-sharing across borders. The piece in the middle that determines who wins is whether the victims feed the defenders.

What this means for your business this week

The defenses below are the same ones I keep writing about. They are the same ones the FBI keeps writing about. They work because the criminals depend on you skipping them.

1. Phone callback on every payment or banking-detail change. Any vendor that changes their remit-to gets a call back at a number from your records, not from the email. Two minutes of process, every time.

2. Multi-factor authentication on every business email account. Phase one of every BEC scheme is inbox compromise. MFA is the single highest-leverage thing you can do to slow that down. Authenticator apps, not SMS where you can avoid it.

3. Audit your mailbox rules monthly. Attackers add quiet forwarding rules so they can read your conversations without you ever seeing alerts. Check yours. Train your team to check theirs. Compromised accounts almost always have a rule that was not there before.

4. Watch for lookalike domains. One letter changed. One extra hyphen. A different top-level domain. The brain skips the difference until you train it not to.

5. Train on the pattern, not the slogan. "Don't click suspicious links" is not training. Walking your team through how a real BEC unfolds, with the actual emails, is training. The criminals are showing real BEC every day to your employees. You should be showing it first.

A word on where this is going

INTERPOL announcements will come more often, not less. Operation Ramz is the first of its kind in MENA but it will not be the last. There will be parallel operations in West Africa, in Southeast Asia, and across the EU. Each one will arrest hundreds. Each one will identify thousands more victims. Each one will seize servers that get replaced within days.

The companies that take a hit in 2026 will not be the ones that ignored the announcements. They will be the ones that read the announcements as somebody else's news. The criminals INTERPOL just took down were targeting Americans. The criminals INTERPOL did not take down are also targeting Americans. The defense work happens at your inbox, your AP team, and your phone, not at a press conference in Lyon.

The question is whether the next advisory is something you read about, or something you live through.

Sources: INTERPOL News, "201 arrests in first-of-its-kind cybercrime operation in MENA region" (May 18, 2026); FBI Internet Crime Complaint Center, 2025 Internet Crime Report; Group-IB press release on Operation Ramz support.