INSPECTING ARCHIVED INTELLIGENCE (OUTDATED VERSION).

Interpol Disables Sniper Dz Phishing-as-a-Service Platform

| 2026-06-12 12:38 LOW HIGH PHISHING & SOCIAL ENGINEERING LAW ENFORCEMENT
JSON
Executive Summary
AI-generated
Una operación internacional coordinada por INTERPOL ha permitido desmantelar Sniper Dz, una plataforma de phishing como servicio que llevaba activa al menos desde 2015 y que facilitaba a otros ciberdelincuentes la creación de campañas fraudulentas para ciberataques a gran escala. La operación se desarrolló entre octubre de 2025 y febrero de 2026 y se saldó con 201 detenciones en 13 países de la región de Oriente Medio y Norte de África, incluyendo al principal desarrollador y administrador de Sniper Dz, Guedz. La plataforma había recopilado más de 45.000 registros de víctimas y operó bajo distintos nombres, como Joker Dz y Storm Dz. Funcionaba como una plataforma de phishing-as-a-service, permitiendo a usuarios con pocos conocimientos técnicos lanzar campañas de robo de credenciales utilizando kits ya preparados. La plataforma ofrecía alrededor de 80 plantillas de phishing en cinco idiomas y se suplantaba a grandes marcas y servicios digitales para engañar a los usuarios y obtener credenciales, información personal y otros datos sensibles.
Technical Mitigations AI-generated
• Network Intrusion Prevention (ATT&CK mitigation for Phishing): Network intrusion prevention systems and systems designed to scan and remove malicious email attachments or links can be used to block activity. • Restrict Web-Based Content (ATT&CK mitigation for Phishing): Determine if certain websites or attachment types (ex: .scr, .exe, .pif, .cpl, etc.) that can be used for phishing are necessary for business operations and consider bloc
Intelligence Metadata
Actors / Malware / CVEs / Campaigns
Operation RamzOperation Ramz
Target & Sectors
MENA MENA AFRICA AFRICA
Incident Timeline
‎2026/06/12
Group-IB and Interpol collaborated to disrupt SniperDz, a phishing-as-a-service platform that had been active since at least 2015.
infrastructure 20,000 unique domains
Over the past nine years, Group-IB identified more than 20,000 unique domains associated with SniperDz that impersonated at least 30 major global organizations, including PayPal, Facebook, Instagram, Yahoo, Netflix and Steam.
victims 30 major global organizations
Over the past nine years, Group-IB identified more than 20,000 unique domains associated with SniperDz that impersonated at least 30 major global organizations, including PayPal, Facebook, Instagram, Yahoo, Netflix and Steam.
infrastructure 53 servers
The results, announced by Interpol at the end of May , included 201 arrests, 53 servers seized and 382 suspects and 3867 victims identified.
victims 3867 victims
The results, announced by Interpol at the end of May , included 201 arrests, 53 servers seized and 382 suspects and 3867 victims identified.
Tactical Metrics
Metrics
infrastructure
20,000
Unique Domains
Over the past nine years, Group-IB identified more than 20,000 unique domains associated with SniperDz that impersonated at least 30 major global organizations, including PayPal, Facebook, Instagram, Yahoo, Netflix and Steam.
Metrics
victims
30
Major Global Organizations
Over the past nine years, Group-IB identified more than 20,000 unique domains associated with SniperDz that impersonated at least 30 major global organizations, including PayPal, Facebook, Instagram, Yahoo, Netflix and Steam.
Metrics
infrastructure
53
Servers
The results, announced by Interpol at the end of May , included 201 arrests, 53 servers seized and 382 suspects and 3867 victims identified.
Metrics
victims
3,867
Victims
The results, announced by Interpol at the end of May , included 201 arrests, 53 servers seized and 382 suspects and 3867 victims identified.
Intelligence Sources
Bit Life Media 2026-06-12
Bit Life Media 2026-06-12
Infosecurity-Magazine 2026-06-11