Interpol led ransomware takedown in 19 countries nets 574 arrests

Dark Reading Confidential follows Will Thomas, a senior threat researcher with Team Cymru, whose work helped Interpol crack a sprawling African cybercrime syndicate. The episode notes that Operation Sentinel, coordinated by Interpol, spanned 19 countries and led to 574 arrests and the recovery of three million, with six ransomware variants decrypted.

Thomas explains that Team Cymru provides strategic support using NetFlow data to map where threat actors host tools and to identify victims, enabling law enforcement to build a more actionable picture. He emphasises that the organisation collaborates with law enforcement as a private sector partner and that permissions across jurisdictions are essential for takedowns.

The discussion also covers Team Cymru’s broader data tools, such as the Ransomware Tool Matrix, and the value of trusted public–private partnerships in disrupting campaigns. Thomas reflects on how law enforcement tactics have evolved, noting decentralisation in initial access threats and the ongoing shift towards data extortion and exploitation of Edge devices. According to Interpol, the operation showcased the power of coordinated international collaboration.