INTERPOL’s Operation Ramz successfully dismantled the long-running Sniper Dz phishing-as-a-service platform, leading to 201 arrests across 13 countries and the seizure of extensive criminal infrastructure and data.

Key Points

• Operation Ramz, conducted between October 2025 and February 2026, resulted in 201 arrests across the Middle East and North Africa.
• Algerian National Police apprehended the platform’s primary developer, known as Guedz, who operated the service since 2015.
• The platform, previously known as Joker Dz and Storm Dz, facilitated the theft of over 45,000 victim records using 80 distinct phishing templates.
• Cybercriminals used the service to target users of 30 major global brands, including PayPal, Facebook, Netflix, and Yahoo.
• Authorities seized hardware and shut down a network that utilized more than 20,000 unique domains to harvest sensitive user credentials.

Why it Matters

The takedown of Sniper Dz removes a significant barrier to entry for cybercriminals by eliminating a free, large-scale infrastructure provider that supported global phishing campaigns. This disruption highlights the effectiveness of international law enforcement cooperation in dismantling sophisticated criminal networks that exploit social engineering and brand impersonation.