Meridiano

Add Article

No Image Available

Article Details

Title

Article: Dark Reading Confidential: This Threat Hunter Helped Cops Bust Up An African Cybercrime Syndicate

Impact Score

5 / 10

AI Summary (Processed Content)

A major African cybercrime syndicate was dismantled through an international law enforcement operation called Sentinel, led by Interpol. The operation resulted in 574 arrests, the recovery of over $3 million, and the decryption of six malware variants. The private cybersecurity firm Team Cymru played a key supporting role, using its unique data and expertise to help track the criminals. The article highlights the collaboration between private sector threat hunters and global law enforcement to combat cybercrime.

Original URL

https://www.darkreading.com/threat-intelligence/threat-hunter-helped-cops-crack-african-cybercrime-syndicate

Source Feed

darkreading

Published Date

2026-03-04 15:00

Fetched Date

2026-03-04 13:39

Processed Date

2026-03-04 13:54

Embedding Status

Present

Cluster ID

Not Clustered

Raw Extracted Content

Breaking cybersecurity news, news analysis, commentary, and other content from around the world, with an initial focus on the Middle East & Africa, Asia Pacific, and Latin America.
Dark Reading Confidential: This Threat Hunter Helped Cops Bust Up An African Cybercrime Syndicate
Dark Reading Confidential Episode 15: Interpol relied on Will Thomas and team to help break up a sprawling cybercrime ring, leading to the arrest of 574 suspects, the recovery of more than $3 million, and the decryption of six malware variants. Here's his story.
Becky Bracken
Hello everyone, and welcome to Dark Reading Confidential. It's a podcast with the editors of Dark Reading, bringing you real world stories straight from the cyber trenches. I'm Becky Bracken, your host. And today I am thrilled to welcome Will Thomas, who is a senior threat researcher with Team Cymru. He was recently involved in a blockbuster breakup of an African cybercrime syndicate operation in conjunction with Interpol. So we wanted to welcome Will today to give us some insights into how that came about and what that was like. So welcome, Will.
Will Thomas
Thanks for having me on. It's been a good opportunity to chat, and I'm happy to dive into a little bit more about the types of role that Team Cymru can play in these international law enforcement operations.
Becky Bracken
Yes, OK, so this was a biggie, and I covered this (Operation Sentinel) just before the end of the year on Dec. 23. And, according to the report from Interpol, involved law enforcement across 19 countries, made 574 arrests, and recovered three million. That's quite a bust, I would say.
Will Thomas
Yes, they did a lot there. Makes me smile, makes me proud to think that we've been involved in this and, you know, hopefully improved a lot of people's lives as a result.
Becky Bracken
So, help us get an idea of how this comes about. How do you first learn about Operation Sentinel? How do you first learn about what your role is potentially going to be working with Interpol on this?
Will Thomas
Yeah, there are a lot of people in Team Cymru, lot of the researchers and experts in Team Cymru, the company is made of many experts and researchers, and we have a lot of people who've been involved in fighting cybercrime and fighting various hostile state campaigns as well. And through that experience, we've kind of built up these relationships over the many, many years that the company's been around.
Team Cymru goes back 25 years since it was created. And the whole time it's always been about, you know, it has a mission to save and improve human lives. And through that simple slogan, you know, we work with law enforcement, we help with takedowns, using the unique data sets that Team Cymru has, we're able to stop these cybercriminal campaigns, because we are able to watch them do things that they don't think they are being watched doing.
Becky Bracken
So your boss comes into your office or pings you on Teams, I assume, and says, Hey, I've got this project for you to work on. Is that how the work gets disseminated out?
Will Thomas
Yes, it can start like that. We have only senior experts in Team Cymru and those people have used their relationships to receive sort of ad hoc requests. So Team Cymru is a strategic private sector partner for multiple law enforcement groups and agencies around the world. And we'll just get an ad hoc request from them. So we will receive these email requests and then we will look into what we can do to help them. And it's always been, there's been basically a way that we've supported these campaigns.
Becky Bracken
So this isn't new work for you or your team over there.
Will Thomas
No, Cymru has been involved in multiple operations in 2025 alone. Multiple Interpol operations. There was one such as Operation Serengeti, MENA, and Synergia, and then this one, Sentinel, which is the one that recently took place across Africa. It's something that they come to us for because of our expertise, but also the data that we have, which we can talk more about in a minute.
Becky Bracken
Yes, so I would like to know more about sort of your specific area of expertise and the data and sort of how you went about tracking down these crime syndicates, which I guess it was several operating in unison, is that correct?
Will Thomas
Yeah. So the interesting thing about this operation, and my expertise as well, is that it's mainly focused on three types of cybercrime that many of the listeners will probably be familiar with. Ransomware, business email compromise, and then data extortion as well. And those types of threat actors are not the most sophisticated, but they are very persistent. They do cause a lot of damage and disruption to various organizations around the world.
And particularly in Africa, where they're not as well defended, right? So as our expertise comes in tracking the infrastructure of these types of threat actors, so that comes in two parts as well. Where are the IP addresses hosting the tools used by these ransomware gangs? And then where are the threat actors who are remoting into them and controlling those IP addresses? And where are and who are the victims? Because we can use our NetFlow data, which I can dive into more as well. We are able to identify not only the victim of a certain C2 server, offensive security tool, hacking tools hosted online, who are the victims of those tools, and then also who's controlling those tools, who's remoting in and taking control of those command and control servers.
Becky Bracken
I would imagine that also comes in pretty frequently when you're trying to do attribution work as well, trying to tie certain infrastructures to various campaigns and groups. Is that something else you're involved in?
Will Thomas
Exactly. My expertise often comes in tracking ransomware campaigns. And from tracking the ransomware threat actors, I like to map out what tools they use and also the infrastructure that they launch those capabilities from. So for example, I created this project called the Ransomware Tool Matrix. It takes all of the tools used by various different ransomware gangs, probably about over 100 on tracking and all of the different tools that they use.
What Team Cymru does is we'll scan and track across the internet where these tools are hosted. So take Cobalt Strike, for example. That's a very common tool that multiple ransomware gangs like to use. Using our NetFlow data, we can see where those Cobalt Strike IPs are hosted, and we can see who are the victims of those Cobalt Strike IPs. And for this specific operation with Interpol, we could see there's a set number of countries that they wanted to support and build this operation around. And we could see victims coming, communicating, beaconing out from their corporate networks to those Cobalt Strike IPs. And the way Team Cymru can do that is we have these partnerships, hundreds of partnerships around the world where we receive NetFlow data. And then that NetFlow data is enriched with, because we know what the victim IP is. Maybe it's like an enterprise gateway, a WAN IP, and then we also know the other side of it, which is this malicious Cobalt strike IP. And if we see the two communicating, then we found a victim. So all of that intelligence about where the threat actors are hosting their control tools, their hacking tools, and the net flow to the victims, then that goes to Interpol and then they can use that to take down these operations.
Becky Bracken
So in the case of Operation Sentinel, which came first? Were you seeing nefarious beacons going to these cobalt strikes C2s? Or did Interpol come to you and say, We think there's some weird stuff going on. Can you take a look at the digital footprint of this?
Will Thomas
As with most law enforcement engagements that we have, law enforcement came to us. But there are other occasions when we'll investigate and identify some malicious activity and we can tip off various agencies. The interesting thing about Team Cymru or the unique thing about Team Cymru, is that as law enforcement, many people may not realize that they can't really act unless there's victims in their jurisdiction. For Interpol to come here and help coordinate this operation, they had to have the cooperation of all the different African countries, police forces, who can respond to these incidents. So that as long as there's a victim in their jurisdiction, then they can respond to it. Unfortunately, because of the nature of the internet, a threat actor who's maybe in Russia could host a C2 server in the Netherlands and then communicate with victims across Africa, for example. So because of the dynamics of international jurisdictions, it takes an international law enforcement agency like Interpol to coordinate those requests, those takedowns, helping police forces work with attorneys and lawyers and things to help prosecute and pass things along and get sign-offs from judges to do those takedowns.
Becky Bracken
That's so interesting because it does hit home when I see, because Interpol has been launching these large scale multinational takedowns and I hadn't considered that it requires them to find and pinpoint victims in their individual jurisdictions and that must be a pretty hefty digital lift if you don't know what you're doing.
Will Thomas
Exactly. And for a lot of organizations, you kind of run into a problem where the threat actor may be hosting something in a country where the law enforcement there are not, not advanced as the US, they're not advanced as the UK, or whoever. Maybe they don't even have a cybercrime unit. So if a threat actor hosts that command and control infrastructure in that country, then getting them to do a take down, getting them to disrupt and seize things can be a lot harder. So that's one of the reasons why threat actors do that. But then that's, again, one of the reasons why Team Cymru is able to come in and help there, because we can show them, here's malicious activity emanating from that jurisdiction, and here's what you can do to stop it.
Becky Bracken
And just to give our audience an idea, this Operation Sentinel, it's spanned 19 countries and involved the takedown of more than 6,000 malicious links and the decryption of six individual ransomware variants. That's an incredible amount of work. And it said that it was a month, months long. I mean, how long of a span of time were you spending on this?
Will Thomas
I believe it was multiple months essentially, was throughout 2025, these operations, they can go on several months and then they can also be divided up into multiple parts. So other previous operations, you know, we're up to part two, part three for some of them. And then for others, you know, there may be just some new initiative that comes along, but maybe the first one can be a year long and the next one can be half a year, depends on the impact of and the progress that we're making.
Becky Bracken
Can you give us some insights into what sort of was the turning point on this operation when you were digging into all of this sort of digital information that was out there? At what point did you realize what you had was a big deal? This wasn't just a run-of-the-mill take down operation.
Will Thomas
Yeah, think Team Cymru, whilst we played a pivotal role, we were one of a group of organizations that helped Interpol here. Our contribution was more strategic to help them with this key aspect of their operation. Whereas some of the other activities they did, like the decryption of ransomware and the arresting of the criminals, that's kind of beyond Team Cymru's. ... We're not out there kicking the doors down as much as we wish. We're more play more of a strategic role. So I think our ability to support them in their mission to do that is really the thing that was enabled them. How can I re-explain it? Our ability to show them where the victims are, as well as other cybersecurity vendors that help them do that as well. It gives them that power to then go and truly investigate things. Instead of essentially just staring at a list of victims, knowing potentially which vector actor is responsible, you actually have to have that technical data, that evidence that you can actually use to go and do real world actions, real world impact.
Becky Bracken
Through a lot of my reporting, it does seem as if at least maybe spiritually the tide seems to be turning with some of these big multinational crackdowns. At least it's sending a message that these cybercriminals can't just operate with impunity because they're in some far-flung outpost, I guess. Is that an outlook that you share? Do you see this sort of as a bigger trend toward getting our arms wrapped around this?
Will Thomas
Yeah, I think that's a great point to raise because from my experience of tracking ransomware over the last four or five years, we have seen a lot of success from law enforcement doing takedowns of malware loader botnets. You know when I first started out in CTI around 2019 we were talking we were discussing things like Emotet and TrickBot, QuackBot, IcedID, you know the massive malware loader botnets that would drop tools like Cobalt Strike and other follow up secondary payloads that would then lead to ransomware deployment. Nowadays, we don't really see that. That's kind of gone away. Ever since we've seen those coordinated takedowns of Emotet and QuackBot, and now with Operation Endgame that Europol has been coordinating, which Team Camry is also part of, we have seen that type of threat evolve. And now I think the initial access the threat actors and the threats that are providing initial access for ransomware gangs is kind of decentralizing. And now it's all becoming about InfoStealers, InfoStealer malware, well as Exploitation of Edge devices, brute forcing, SSH and RDP brute forcing. So these types of threats are actually becoming a little bit more spread out. You know, there's not so much a massive big botnet that we all have to worry about. Now it's just a constant threat from all sorts of different angles.
So the threat is evolving and it just means maybe the gaps aren't as big anymore but they're smaller and more numerous.
Becky Bracken
What is your sense of the impact this is having on what about a year ago we were reporting on as this highly professionalized, sort of mechanized ransomware operations that were, you you could have your affiliates, you know, they were just these becoming these really professionalized operations. Have we been able to make a dent in those and sort of halt any of their progress?
Will Thomas
Yeah, from what I've seen over the last four or five years, has been a significant number of takedowns. Law enforcement has been putting a lot of pressure on ransomware gangs over the last couple of years. I will say law enforcement's tactics have evolved. There has been some interesting strategies taken, things like sanctioning a ransomware gang only for them to rebrand. We've seen law enforcement kind of hacking back, hacking into the infrastructure and basically collecting, retrieving, seizing the decryption keys and helping victims decrypt. And then more recently, maybe the beginning of last year, we saw, or the beginning of 2024, we saw Operation Chronos, which kind of stands out in my mind, which was led by the UK and actually was shown to be that if you can sow distrust, if you can show the criminals, tarnish the criminals reputation, make them think that they can't trust anyone anymore, make them know that show them that law enforcement is watching them. That really disrupts the ecosystem as well. That really causes them to stop trusting on brands, you know, with the lock bit ransomware gang. I don't think any serious threat actor would consider partnering with them anymore due to the fact that the law enforcement compromised them and was watching them for months. And even took over their own darknet infrastructure. So with all that disruption going on, I think again, the same thing is happening in the ransomware ecosystem as it happened with the malware ecosystem. Things have decentralized. There's a lot of leaked tools out there that a lot of groups are picking up, spinning up a very simple concept of a group or a brand.
Only to as soon as they get reported on a few times disappear and rebrand I mean, it's not that hard anymore when all the tools are free. They're freely available on GitHub or some free website out there. Or the ransomware code itself is spread around freely on the underground, too.
Becky Bracken
It strikes me that the work you do is sort of the purest aspirational when you dream of, you know, going to work and hunting down cyber criminals and engaging with law enforcement. That seems like, to say the least, a really exciting piece of working in cybersecurity.
If there are listeners out there, and I know there are, who would like to work their way into the kind of work that you do, whether you or your teammates, what sort of skill set do you think that they might consider working on and tooling up on, scaling up on?
Will Thomas
Great question. I often come across and talk to aspiring researchers, people who have shown a lot of skill and talent. They want to be a part of helping to disrupt these operations. But at the end of the day, the researchers must cooperate with the law enforcement, otherwise we're never going to get anything done.
And when you have researchers disrupting law enforcement operations, you know, that's when, you know, we're not helping each other. So my key advice for any researcher who feels like they would want their skills and their research to be more impactful, then it's all about building those relationships and it's all about trust. At the end of the day, a lot of the cybersecurity industry is built on trust. You're not going to hire someone that you don't trust. A lot of the, a lot of the jobs and things out there are based on, you know, I know this, I know this person already and I trust them. So I trust them to do the job for dealing with sensitive data. I trust they're not going to exploit it.
So it's going, going to conferences, going to not just, you know, your Infosecurity Europe or something like that. That is a great conference, has its purpose, but going to the more specific, law enforcement, researcher, private public industry collaboration events, getting invited to those would probably be the key way to do it. That's the way that I did it. The UK has a pretty good community of law enforcement and then also the government, the UK NCSC. They've been very inviting. They've been working, bringing researchers in, doing conferences together, presentations.
As long as you show that you're good at doing cybersecurity research, you're good at investigating cyber criminals, eventually you'll come across someone who knows someone who's willing to give you a chance. As long as you don't burn that chance and you trust each other and you don't overshare or do any disruptive activities, then you can foster those relationships for years to come, as I have done.
Becky Bracken
That's excellent advice. I wanted to know for my own curiosity: Do you have to concern yourself with your own security based on this work that you're doing? How much extra effort are you putting into covering your tracks and making sure you don't get cross ways with some of these people?
Will Thomas
Yeah, I mean, it's a fair comment. It is always important to go over your own personal security. You know, I've created guides to help other people to maintain their own personal security. As long as you follow your own advice, then things should be OK. It's kind of difficult for me in some ways because I'm somewhat have to be public facing. I have to go to conferences. I have to do podcasts and you know, you put my name out there a little bit my face out there. But I will, you know, try and do things to make sure that, you know, people who I'm with, my friends and family, are not not exposed to that not expect not going to face repercussions. By taking various measures, you know training them giving them to cybersecurity awareness training. Because I may have the best, you know, cybersecurity personal security out there, not saying that I do, but it's going to be as good as I can make it, but it could just take one slip from someone else who I'm connected to, for them to have a really bad day because of, because of the work that I do. So I do have to be, you know, education. I do have to talk about education. You know, don't, don't share pictures of me in social media or that sort of stuff. and yeah, it's all you just, it's a constant battle. You have to constantly, it's constant education. You can't say it once. You have to always remind people.
Becky Bracken
Well, Will Thomas, I want to thank you so much for the work that you do and for being willing to share it with us and put your face out there. We very much appreciate it. Your work is fascinating and so important. So thank you so much.
Will Thomas
Thank you. Yeah, I appreciate the opportunity to come on. And the last thing I'll say is that Team Cymru is a very community-focused organization. And this is kind of a, in a way, it's a call to action for organizations to potentially hear us out when we say, can make a difference, you can help us make a difference in the world through our partnerships that we have.
Becky Bracken
That is a perfect place to leave it. Thank you so much, Will Thomas. This has been Dark Reading Confidential, a podcast from the editors of Dark Reading. And on behalf of everyone over here, I want to thank you so much for listening. We'll see you on a future episode. Bye.
Read more about:
DR Global Middle East & Africa