Interpol-led operation dismantles nearly 11,000 cybercrime networks across Africa

Interpol announced the results of Operation Serengeti III on October 22, 2026, a coordinated crackdown that ran from June 29 to August 31 across 21 African countries. Authorities dismantled 10,909 malicious networks, arrested 1,462 suspected cybercriminals, and identified 65,929 victims with estimated losses exceeding $385 million. Investigators recovered more than $105 million in illicit funds.

The operation targeted business email compromise (BEC), ransomware, and online scams, and drew on intelligence support from private-sector partners Team Cymru, Kaspersky, Group-IB, and Fortinet. Team Cymru supplied data on suspicious domains, IP addresses, and command-and-control infrastructure used to identify criminal networks before law enforcement moved in.

Notable cases

In Uganda, authorities dismantled two transnational fraud rings and arrested 365 people in connection with suspected online investment and pension fraud schemes. In Angola, raids on illegal cryptocurrency mining centers led to nine arrests and the seizure of more than 2,000 mining devices. In Nigeria, investigators arrested a suspect allegedly running a large-scale phishing and business email compromise operation that had harvested roughly 2.1 million email addresses along with stolen software credentials. Other actions targeted malicious mobile lending apps, fraudulent vehicle import schemes, and cryptocurrency investment scams.

Part of a growing annual pattern

Serengeti III is the third iteration of the operation and the largest yet by arrest count. The original 2024 operation covered 19 countries, led to 1,006 arrests, and took down 134,089 malicious infrastructures, recovering about $44 million. Serengeti 2.0 in mid-2025 produced 1,209 arrests, 11,432 dismantled infrastructures, and $97.4 million in seized funds. This year’s operation arrested more people than either prior round despite dismantling fewer total network nodes, suggesting investigators are increasingly able to trace infrastructure back to the individuals operating it rather than just taking down servers and domains.

The scale of the financial losses identified — $385 million across just 65,929 confirmed victims — underscores how costly business email compromise and investment fraud schemes have become even when measured against a relatively contained set of known cases. As reported by BleepingComputer, the operation’s reliance on private threat-intelligence firms alongside law enforcement reflects a broader shift in how cross-border cybercrime investigations are run: national police forces increasingly depend on commercial security vendors to map criminal infrastructure before arrests can even be planned.