Skip to main content
Back to the takedown index

INTERPOL Operation Secure

June 2025, Malware and botnets
Led by International Criminal Police Organization

Extended pass entry, last reviewed August 21, 2026

What was taken down?

More than 20,000 malicious IPs/domains taken down; 41 servers seized.

See what happened

What happened to the people?

Officials reported 32 apprehended.
Group accounted for: Partial

See people and accountability

Did it stay down?

Not established in the public record. No later activity is recorded against this entry.

See what happened afterward

INTERPOL's Operation Secure reported more than 20,000 malicious IPs/domains taken down, 41 servers seized, and 32 arrests across a 26-country infostealer crackdown.

Date
June 2025
Target
Infostealer malware infrastructure (26-country action), infostealer malware
Activity
Malware and botnets
Operational lead
INTERPOL
Jurisdiction
Not established
Outcome
More than 20,000 malicious IPs/domains taken down; 41 servers seized.
Status
Completed
Legal mechanism
Coordinated national judicial/search-and-seizure authority across 26 countries.
Group accounted for
Partial

No individual is named against this entry in the cited record. That is a gap in what has been published rather than a finding that nobody was involved.

Group accounted for: Partial

The cited record does not say how large the group was or whether everyone involved has been identified.

See the organizations and roles behind this action

Not established in the public record. No later activity is recorded against this entry.

Numbered markers throughout this entry link to the source that supports the claim beside them.

Official sources

  1. [1]
    Operation Secure: INTERPOL-coordinated action takes down 20,000+ malicious IPs and domains

    INTERPOL, June 11, 2025, Source grade P2

    Establishes the 26-country scope, 20,000+ IP/domain figure, 41 servers seized, and 32 arrests.

    No address recorded for this source. Publisher, title, and date are given so it can be retrieved from the publisher.

Coverage note. Added from deep-research aggregation pass. Not independently re-verified source-by-source to the same standard as the original 38-incident core; source_quality capped at S2/P2 pending a dedicated verification pass.