INTERPOL and law enforcement agencies from 21 countries have arrested 1,462 suspected cybercriminals and dismantled nearly 11,000 malicious networks in a major crackdown on cybercrime across Africa.
The operation also led to the recovery of more than $105 million in illicit funds linked to online scams, ransomware and business email compromise attacks.
Dubbed Operation Serengeti III, the coordinated campaign ran from June 29 to August 31, 2026, with support from private cybersecurity companies including Team Cymru, Kaspersky, Group-IB and Fortinet. According to INTERPOL, investigators identified 65,929 victims and estimated the financial losses associated with the investigated criminal activities at more than $385 million.
Uganda recorded one of the largest arrest totals, with authorities detaining 365 people suspected of involvement in transnational fraud schemes targeting online investors and pension holders. Investigators dismantled two suspected criminal rings linked to these operations.
In Angola, authorities uncovered illegal cryptocurrency mining facilities, arrested nine suspects and seized more than 2,000 mining devices. The action targeted operations using unauthorized infrastructure to mine digital currencies.
Nigeria also featured in the investigation, with authorities arresting a suspect accused of operating a large-scale phishing and business email compromise operation. Investigators said the operation harvested software credentials and collected approximately 2.1 million email addresses, potentially exposing victims to further fraud and account compromise.
Operation Serengeti III also targeted malicious mobile lending applications, fraudulent vehicle import schemes and cryptocurrency investment scams. These operations can cause significant financial damage by exploiting victims’ trust, stealing account credentials or promising investment returns that never materialize.
Private cybersecurity firms played a key role by sharing threat intelligence and technical expertise with investigators. Team Cymru and other partners provided information about suspicious domains, IP addresses and command-and-control infrastructure used by criminal networks. Such data helped authorities connect malicious activity, map suspected operations and identify individuals linked to the attacks.
Jacomo Piccolini, Team Cymru’s vice president of global data partnerships, said visibility into attacker infrastructure across the internet can help defenders identify criminal networks before additional attacks occur. In a company announcement, he highlighted the importance of using large-scale threat intelligence to support investigations and defensive action.
The latest crackdown follows two earlier operations targeting cybercrime across Africa. The first Operation Serengeti, conducted between September and October 2024 across 19 African countries, resulted in 1,006 arrests, the takedown of 134,089 malicious infrastructures and networks, and the recovery of approximately $44 million.
If this article helped you, please consider supporting our work. Every small contribution keeps Abijita.com independent and running.
Operation Serengeti 2.0, conducted between June and August 2025, led to 1,209 arrests, the dismantling of 11,432 malicious infrastructures and the seizure of $97.4 million. The third operation continues the regional effort to disrupt cybercriminal groups responsible for online fraud and other digital crimes.
INTERPOL Arrests 1,462 Suspects and Disrupts Nearly 11,000 Cybercrime Networks
