Global law enforcement action in Asia nets large infrastructure seizure, 32 arrests | CyberScoop<\/title> <meta name=\"description\" content=\"Operation Secure targeted malicious IPs, domains and servers used for infostealer operations that claimed more than 216,000 victims.\"> <link rel=\"canonical\" href=\"https:\/\/cyberscoop.com\/operation-secure-asia-takedown\/\"> <meta property=\"og:locale\" content=\"en_US\"> <meta property=\"og:type\" content=\"article\"> <meta property=\"og:title\" content=\"Global law enforcement action in Asia nets large infrastructure seizure, 32 arrests\"> <meta property=\"og:description\" content=\"Operation Secure targeted malicious IPs, domains and servers used for infostealer operations that claimed more than 216,000 victims.\"> <meta property=\"og:url\" content=\"https:\/\/cyberscoop.com\/operation-secure-asia-takedown\/\"> <meta property=\"og:site_name\" content=\"CyberScoop\"> <meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/cyberscoop\/\"> <meta property=\"article:published_time\" content=\"2025-06-11T18:54:51+00:00\"> <meta property=\"article:modified_time\" content=\"2025-06-11T18:54:54+00:00\"> <meta property=\"og:image\" content=\"https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2025\/06\/global-law-enforcement-action-in-asia-nets-large-infrastructure-seizure-32-arrests-1.png\"> <meta property=\"og:image:width\" content=\"1024\"> <meta property=\"og:image:height\" content=\"675\"> <meta property=\"og:image:type\" content=\"image\/png\"> <meta name=\"author\" content=\"Matt Kapko\"> <meta name=\"twitter:card\" content=\"summary_large_image\"> <meta name=\"twitter:creator\" content=\"@CyberScoopNews\"> <meta name=\"twitter:site\" content=\"@CyberScoopNews\">  <link rel=\"dns-prefetch\" href=\"\/\/securepubads.g.doubleclick.net\">\n<link rel=\"dns-prefetch\" href=\"\/\/use.typekit.net\">\n<link rel=\"alternate\" type=\"application\/rss+xml\" title=\"CyberScoop \u00bb Feed\" href=\"https:\/\/cyberscoop.com\/feed\/\">\n<link rel=\"alternate\" type=\"application\/rss+xml\" title=\"CyberScoop \u00bb Comments Feed\" href=\"https:\/\/cyberscoop.com\/comments\/feed\/\"> <link rel=\"stylesheet\" id=\"all-css-2\" href=\"https:\/\/cyberscoop.com\/wp-includes\/css\/dist\/block-library\/style.min.css?m=1746040294g\" type=\"text\/css\" media=\"all\"> <link rel=\"stylesheet\" id=\"all-css-6\" href=\"https:\/\/cyberscoop.com\/wp-content\/mu-plugins\/search\/elasticpress\/dist\/css\/related-posts-block-styles.min.css?m=1748964495g\" type=\"text\/css\" media=\"all\"> <link rel=\"stylesheet\" id=\"all-css-8\" href=\"https:\/\/cyberscoop.com\/wp-content\/themes\/scoopnewsgroup\/dist\/css\/frontend.css?m=1748220166g\" type=\"text\/css\" media=\"all\">\n<link rel=\"stylesheet\" id=\"typekit-css\" href=\"https:\/\/use.typekit.net\/itk2qbh.css?ver=13897d660a0ac2c9c7d1\" media=\"all\"> <link rel=\"https:\/\/api.w.org\/\" href=\"https:\/\/cyberscoop.com\/wp-json\/\"><link rel=\"alternate\" title=\"JSON\" type=\"application\/json\" href=\"https:\/\/cyberscoop.com\/wp-json\/wp\/v2\/posts\/84869\"><link rel=\"EditURI\" type=\"application\/rsd+xml\" title=\"RSD\" href=\"https:\/\/cyberscoop.com\/xmlrpc.php?rsd\">\n<meta name=\"generator\" content=\"WordPress 6.8.1\">\n<link rel=\"shortlink\" href=\"https:\/\/cyberscoop.com\/?p=84869\">\n<link rel=\"alternate\" title=\"oEmbed (JSON)\" type=\"application\/json+oembed\" href=\"https:\/\/cyberscoop.com\/wp-json\/oembed\/1.0\/embed?url=https%3A%2F%2Fcyberscoop.com%2Foperation-secure-asia-takedown%2F\">\n<link rel=\"alternate\" title=\"oEmbed (XML)\" type=\"text\/xml+oembed\" href=\"https:\/\/cyberscoop.com\/wp-json\/oembed\/1.0\/embed?url=https%3A%2F%2Fcyberscoop.com%2Foperation-secure-asia-takedown%2F&format=xml\">   <link rel=\"icon\" href=\"https:\/\/cyberscoop.com\/wp-content\/uploads\/sites\/3\/2023\/01\/cropped-cs_favicon-2.png?w=32\" sizes=\"32x32\">\n<link rel=\"icon\" href=\"https:\/\/cyberscoop.com\/wp-content\/uploads\/sites\/3\/2023\/01\/cropped-cs_favicon-2.png?w=192\" sizes=\"192x192\">\n<link rel=\"apple-touch-icon\" href=\"https:\/\/cyberscoop.com\/wp-content\/uploads\/sites\/3\/2023\/01\/cropped-cs_favicon-2.png?w=180\">\n<meta name=\"msapplication-TileImage\" content=\"https:\/\/cyberscoop.com\/wp-content\/uploads\/sites\/3\/2023\/01\/cropped-cs_favicon-2.png?w=270\"> <\/head><body class=\"wp-singular post-template-default single single-post postid-84869 single-format-standard wp-theme-scoopnewsgroup wp-child-theme-cyberscoop\" id=\"readabilityBody\"> <a href=\"https:\/\/cyberscoop.com\/operation-secure-asia-takedown\/#main\" class=\"skip-to-content-link visually-hidden-focusable\">Skip to main content<\/a> <\/p>\n<div class=\"ad ad--top ad--top-desktop\">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<p> <main id=\"main\" role=\"main\" tabindex=\"-1\"> <\/p>\n<div class=\"ad ad--top ad--top-mobile\">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<section id=\"stickybar\" class=\"stickybar stickybar--event js-stickybar\">\n<div class=\"stickybar__details\" readability=\"4.9180327868852\">\n<div class=\"stickybar__info js-sticky-bar-content\" readability=\"32\">\n<p>Voting is open for the 2025 CyberScoop 50 awards!<\/p>\n<\/div>\n<p> <a class=\"stickybar__link button button-tertiary\" href=\"https:\/\/cyberscoop.com\/cyberscoop50\/\">Click here!<\/a> <\/div>\n<p> <button class=\"stickybar__close js-stickybar-close\" aria-controls=\"stickybar\"> <svg class=\"icon icon--close\" width=\"21\" height=\"22\" viewBox=\"0 0 21 22\" fill=\"none\"><path d=\"m.822.518-.805.805L9.695 11 .017 20.678l.805.805 9.678-9.678 9.677 9.678.806-.805L11.305 11l9.678-9.677-.806-.805-9.677 9.677L.822.518Z\" fill=\"currentColor\" \/><\/svg> <span class=\"visually-hidden\">Close<\/span> <\/button> <\/section>\n<article class=\"single-article content\">\n<div class=\"single-article__container js-single-article-content\">\n<header class=\"single-article__header \" readability=\"26.375255623722\">\n<div class=\"single-article__header-content\" readability=\"36.141809290954\">\n<ul class=\"single-article__eyebrow\">\n<li class=\"single-article__category\"> <a class=\"single-article__category-link\" href=\"https:\/\/cyberscoop.com\/operation-secure-asia-takedown\/\"> <span>Cybercrime<\/span> <\/a> <\/li>\n<\/ul>\n<p> Operation Secure targeted malicious IPs, domains and servers used for infostealer operations that claimed more than 216,000 victims. <\/p>\n<p>  <br \/>\n<audio id=\"audio-player\" src=\"https:\/\/wp-tts-cdn.api.scpnewsgrp.com\/cyberscoop\/84869\/english.openai.mp3\"><\/audio> <\/p>\n<div readability=\"11\">\n<div>\n<p>Listen to this article<\/p>\n<p>  <\/p>\n<p>0:00<\/p>\n<\/p><\/div>\n<p>  <\/p>\n<p> <span id=\"tts-tooltip\">Learn more.<\/span> <span> This feature uses an automated voice, which may result in occasional errors in pronunciation, tone, or sentiment. <\/span> <\/p>\n<\/div>\n<p>  <\/div>\n<div class=\"single-article__cover-wrap\">\n<figure class=\"single-article__cover\"> <img data-recalc-dims=\"1\" fetchpriority=\"high\" width=\"640\" height=\"422\" src=\"https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2025\/06\/global-law-enforcement-action-in-asia-nets-large-infrastructure-seizure-32-arrests.png?resize=640%2C422&ssl=1\" class=\"single-article__cover-image wp-post-image\" alt=\"Authorities seized 41 servers during Operation Secure.\" decoding=\"async\" fetchpriority=\"high\" srcset=\"https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2025\/06\/global-law-enforcement-action-in-asia-nets-large-infrastructure-seizure-32-arrests-1.png 1024w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2025\/06\/global-law-enforcement-action-in-asia-nets-large-infrastructure-seizure-32-arrests-1.png?resize=300,198 300w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2025\/06\/global-law-enforcement-action-in-asia-nets-large-infrastructure-seizure-32-arrests-1.png?resize=768,506 768w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2025\/06\/global-law-enforcement-action-in-asia-nets-large-infrastructure-seizure-32-arrests-1.png?resize=600,396 600w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2025\/06\/global-law-enforcement-action-in-asia-nets-large-infrastructure-seizure-32-arrests-1.png?resize=255,168 255w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2025\/06\/global-law-enforcement-action-in-asia-nets-large-infrastructure-seizure-32-arrests-1.png?resize=511,337 511w\" sizes=\"(max-width: 1024px) 100vw, 1024px\"><figcaption> Authorities seized 41 servers during Operation Secure. (Photo credit: Interpol) <\/figcaption><\/figure>\n<\/p><\/div>\n<\/header>\n<div class=\"single-article__content\">\n<div class=\"single-article__content-inner has-drop-cap\"> <html readability=\"48.883701883702\"><body readability=\"97.976579352851\"><\/p>\n<p>Authorities from 26 countries scored another win in the global crackdown on cybercrime earlier this year, chipping away at multiple operations in Asia by arresting dozens of alleged cybercriminals and seizing a vast array of infrastructure, Interpol announced Wednesday. <\/p>\n<p><a href=\"https:\/\/www.interpol.int\/News-and-Events\/News\/2025\/20-000-malicious-IPs-and-domains-taken-down-in-INTERPOL-infostealer-crackdown\">Operation Secure<\/a>, which ran through the first four months of the year, targeted physical and virtual systems used for infostealer operations that claimed more than 216,000 victims, officials said. <\/p>\n<p>Law enforcement agencies seized 41 physical servers, more than 100 GB of data and took down more than 20,500 malicious IPs and domains. Local police in Vietnam, Sri Lanka and Naura arrested a combined 32 suspects as part of the operation, according to officials.<\/p>\n<p>Global authorities said 69 infostealer variants were investigated as part of the operation, including prolific infostealer malware such as Lumma, Risepro and Meta Stealer, the cybercriminals command-and-control infrastructure and accounts used to advertise the malware and stolen data.<\/p>\n<div class=\"ad ad--inline_1 \">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<p>The takedowns and arrests come amid a recent burst of law enforcement action against cybercrime. During the past few weeks, authorities seized and took down infrastructure supporting the counter antivirus service <a href=\"https:\/\/cyberscoop.com\/avcheck-global-takedown\/\">AVCheck<\/a>, the <a href=\"https:\/\/cyberscoop.com\/lumma-stealer-infostealer-takedown\/\">prolific Lumma Stealer<\/a> infostealer operation, <a href=\"https:\/\/cyberscoop.com\/danabot-malware-botnet-seizure-takedown\/\">DanaBot\u2019s malware-as-a-service operations<\/a>, and <a href=\"https:\/\/cyberscoop.com\/operation-endgame-ransomware-infrastructure-takedown-europol\/\">hundreds of domains and servers<\/a> used across several leading malware strains.<\/p>\n<p>\u201cInterpol continues to support practical, collaborative action against global cyber threats,\u201d Neal Jetton, Interpol\u2019s director of cybercrime, said in a prepared statement. \u201cOperation Secure has once again shown the power of intelligence sharing in disrupting malicious infrastructure and preventing large-scale harm to both individuals and businesses.\u201d<\/p>\n<p>The Asia and South Pacific Joint Operations Against Cybercrime Project organized the regional Operation Secure initiative with threat intelligence assistance from Group-IB, Kaspersky and Trend Micro.<\/p>\n<p>Authorities said they sent notices to more than 216,000 victims who had personally identifiable information stolen by the infostealers, including credentials, cookies, credit card details and cryptocurrency account data.<\/p>\n<p>\u201cThe compromised credentials and sensitive data acquired by cybercriminals through infostealer malware often serve as initial vectors for financial fraud and ransomware attacks,\u201d Group-IB CEO Dmitry Volkov said in a <a href=\"https:\/\/www.group-ib.com\/media-center\/press-releases\/interpol-infostealer-bust\/\">blog post<\/a>. \u201cBy sharing actionable intelligence with INTERPOL and local law enforcement agencies, we are helping to dismantle the infrastructure behind these attacks, and protecting both organizations and individuals globally.\u201d<\/p>\n<div class=\"ad ad--inline_1 \">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<p>Acting on information shared by Interpol, the Hong Kong Police Force identified 117 command-and-control servers hosted across 89 internet service providers, which the cybercriminals used to launch and manage their malicious campaigns.<\/p>\n<p>The group of countries involved in Operation Secure include: Brunei, Cambodia, Fiji, Hong Kong, India, Indonesia, Japan, Kazakhstan, Kiribati, Korea, Laos, Macau, Malaysia, Maldives, Nauru, Nepal, Papua New Guinea, the Philippines, Samoa, Singapore, Solomon Islands, Sri Lanka, Thailand, Timor-Leste, Tonga, Vanuatu and Vietnam.<\/p>\n<p><\/body> <\/p>\n<footer class=\"single-article__footer\" readability=\"4.2410071942446\">\n<div class=\"author-card\" readability=\"14\">\n<div class=\"author-card__avatar\">\n<figure class=\"author-card__image-wrap\"> <img data-recalc-dims=\"1\" decoding=\"async\" class=\"author-card__image\" src=\"https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2025\/06\/global-law-enforcement-action-in-asia-nets-large-infrastructure-seizure-32-arrests.jpg?w=640&ssl=1\" alt=\"Matt Kapko\"> <\/figure>\n<\/p><\/div>\n<p><h4 class=\"author-card__name\">Written by Matt Kapko<\/h4>\n<p> Matt Kapko is a reporter at CyberScoop. His beat includes cybercrime, ransomware, software defects and vulnerability (mis)management. The lifelong Californian started his journalism career in 2001 with previous stops at Cybersecurity Dive, CIO, SDxCentral and RCR Wireless News. Matt has a degree in journalism and history from Humboldt State University. <\/p>\n<\/p><\/div>\n<div class=\"single-article__tags-container\">\n<h4 class=\"single-article__tags-title\">In This Story<\/h4>\n<\/p><\/div>\n<\/footer>\n<p> <\/html><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<div class=\"single-article__ads js-single-article-sidebar\">\n<div class=\"ad ad--sidebar js-single-article-sidebar-5 ad--rightrail_1 \">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<div class=\"ad ad--sidebar js-single-article-sidebar-4 ad--rightrail_2 \">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<div class=\"ad ad--sidebar js-single-article-sidebar-3 ad--rightrail_3 \">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div><\/div>\n<\/article>\n<div class=\"popular-stories popular-stories--single-post\">\n<div class=\"popular-stories__container\">\n<h2 class=\"popular-stories__title\"> More Scoops <\/h2>\n<p>  <\/div>\n<p>\n<\/div>\n<p> <\/p>\n<section class=\"latest-podcasts\">\n<h2 class=\"latest-podcasts__title\"> Latest Podcasts\t<\/h2>\n<\/section>\n<div class=\"top-categories\">\n<div class=\"top-categories__container\">\n<h3 class=\"top-categories__category-title\">Government<\/h3>\n<\/p><\/div>\n<div class=\"top-categories__container\">\n<h3 class=\"top-categories__category-title\">Technology<\/h3>\n<\/p><\/div>\n<\/p><\/div>\n<p> <\/main> <\/p>\n<div class=\"ad ad--bottom \">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<div id=\"interstitial\" class=\"welcome__container\"> <button id=\"close-modal-1\" class=\"welcome__clickable_area\"><\/button> <\/p>\n<div class=\"welcome__ad_wrapper\">\n<p> <button id=\"close-modal-3\" class=\"welcome__continue-button\">Continue to CyberScoop<\/button> <\/p>\n<\/p><\/div>\n<\/p><\/div>\n<p>   <\/body> <a href=\"https:\/\/cyberscoop.com\/operation-secure-asia-takedown\/\">Source<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Global law enforcement action in Asia nets large infrastructure seizure,<\/p>\n","protected":false},"author":11,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[4415,282,78,782],"tags":[4416,286,86,787],"class_list":["post-7730","post","type-post","status-publish","format-standard","hentry","category-arrest","category-cybercrime","category-cybersecurity","category-interpol","tag-arrest","tag-cybercrime","tag-cybersecurity","tag-interpol"],"featured_image_urls":{"full":"","thumbnail":"","medium":"","medium_large":"","large":"","1536x1536":"","2048x2048":"","chromenews-featured":"","chromenews-large":"","chromenews-medium":""},"author_info":{"display_name":"Cyber Scoop","author_link":"https:\/\/ddi.mohflo.net\/index.php\/author\/cyberscoop\/"},"category_info":"<a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/arrest\/\" rel=\"category tag\">Arrest<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/cybercrime\/\" rel=\"category tag\">cybercrime<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/cybersecurity\/\" rel=\"category tag\">Cybersecurity<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/interpol\/\" rel=\"category tag\">Interpol<\/a>","tag_info":"Interpol","comment_count":"0","jetpack_featured_media_url":"","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/posts\/7730","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/users\/11"}],"replies":[{"embeddable":true,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/comments?post=7730"}],"version-history":[{"count":0,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/posts\/7730\/revisions"}],"wp:attachment":[{"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/media?parent=7730"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/categories?post=7730"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/tags?post=7730"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}

{"id":7730,"date":"2025-06-11T13:54:51","date_gmt":"2025-06-11T18:54:51","guid":{"rendered":"https:\/\/cyberscoop.com\/?p=84869"},"modified":"2025-06-11T13:54:51","modified_gmt":"2025-06-11T18:54:51","slug":"global-law-enforcement-action-in-asia-nets-large-infrastructure-seizure-32-arrests","status":"publish","type":"post","link":"https:\/\/ddi.mohflo.net\/index.php\/2025\/06\/11\/global-law-enforcement-action-in-asia-nets-large-infrastructure-seizure-32-arrests\/","title":{"rendered":"Global law enforcement action in Asia nets large infrastructure seizure, 32 arrests"},"content":{"rendered":"