Interpol announced the successful completion of Operation Kairos on Monday, a coordinated law enforcement action spanning 47 countries that resulted in the simultaneous arrest of 432 individuals and the disruption of a sophisticated criminal network responsible for an estimated $2.3 billion in losses from ransomware attacks, romance fraud, business email compromise schemes, and cryptocurrency investment fraud targeting victims across six continents. The operation, which Interpol described as the largest single cybercrime law enforcement action in history by number of countries involved and financial damages attributed, was the culmination of an 18-month joint investigation coordinated by Interpol’s Cybercrime Directorate in Singapore and involving law enforcement agencies including the FBI, Europol, South Korea‘s Cyber Investigation Team, Nigeria’s Economic and Financial Crimes Commission, and national police forces from every continent.

The network dismantled in Operation Kairos operated as a sophisticated criminal enterprise with specialized divisions mirroring the organizational structure of a legitimate technology business. AP News reported that the network included technical teams responsible for developing and maintaining ransomware and malware toolkits; recruitment and management operations focused on identifying and controlling pig-butchering fraud victims across Southeast Asia (where many operatives worked under conditions of forced labor in criminal compounds in Cambodia, Myanmar, and Laos); money laundering specialists who converted criminal proceeds through cryptocurrency mixing services, over-the-counter brokers, and money service businesses in jurisdictions with weak anti-money-laundering enforcement; and senior management figures in Europe and the Middle East who oversaw overall operations and managed relationships with corrupt officials in several countries who protected the network’s infrastructure. BBC News noted that the forced labor dimension of the operation exposed a particularly disturbing element of modern organized cybercrime, in which trafficked workers from China, Taiwan, Malaysia, and Vietnam are coerced into conducting fraud against victims under threat of violence.

The ransomware component of the network had targeted hospitals, school districts, municipal governments, and small businesses across North America and Europe, with particularly damaging attacks against healthcare facilities in 2024 and 2025 that disrupted patient care and contributed to treatment delays. Several of the ransomware attacks resulted in patient harm through delayed emergency procedures and forced diversion of ambulances from affected hospitals. Europol’s statement on the operation specifically cited the healthcare targeting as among the most serious elements of the network’s criminal conduct and noted that the arrests include specific individuals identified as responsible for planning and executing the hospital ransomware campaigns.

The 432 arrests include suspects identified as senior network leaders in Dubai, Bucharest, Lagos, and Chiang Mai, technical developers in Eastern Europe and Russia, and hundreds of lower-level fraud operators in the Southeast Asian compound operations. Reuters reported that cooperation from the Chinese public security ministry was instrumental in identifying and detaining several suspects linked to the network’s cryptocurrency laundering infrastructure, representing a degree of China-US law enforcement cooperation on cybercrime that has been notably limited in recent years due to broader geopolitical tensions. Seized assets include approximately $180 million in cryptocurrency across hundreds of wallets, luxury vehicles, real estate in six countries, and server infrastructure in fourteen jurisdictions. Interpol Secretary General Valdecy Urquiza described Operation Kairos as “a demonstration that the international law enforcement community can match the global scale and sophistication of modern cybercrime when we act together.”