Threat Intelligence
Interpol cybercrime sweep in Africa leads to 1,462 arrests and $105m recovered
Interpol’s Operation Serengeti III led to 1,462 arrests across 21 countries, disrupted over 10,900 criminal networks, and recovered more than $105 million in illicit funds.
Ross Grant2 min read
The short version
Interpol coordinated a large crackdown on cybercrime across Africa and the United States. Police arrested 1,462 people and recovered over $105 million stolen through scams, ransomware, and online fraud. The operation identified nearly 66,000 victims and disrupted thousands of criminal networks. It shows how international cooperation can help fight cybercrime.
By the numbers
- 1,462people arrested across 21 countriesHelp Net Security, Hackread
- $105 millionillicit funds recoveredHelp Net Security, Hackread
- 10,909malicious networks dismantledHelp Net Security, Hackread
- 65,929victims identifiedHelp Net Security, Hackread
- $385 millionlinked financial lossesHelp Net Security, Hackread
What happened?
Interpol’s Operation Serengeti III led to 1,462 arrests in 21 countries, mainly in Africa, between June and August 2026. Police dismantled over 10,900 malicious networks and recovered more than $105 million in illicit funds. Investigators identified nearly 66,000 victims and linked criminal activity to losses exceeding $385 million. The operation targeted fraud, ransomware, phishing, and cryptocurrency crimes.
Who is affected
Operation Serengeti III targeted cybercrime networks in 21 countries, including 20 across Africa and the United States. According to Help Net Security (opens in a new tab) and Hackread (opens in a new tab), investigators identified 65,929 victims of fraud, ransomware, business email compromise, online scams, and digital extortion. The operation ran from 29 June to 31 August 2026.
How the attack worked
The crackdown focused on a range of cybercrimes. In Uganda, police dismantled two transnational fraud rings that operated call centres and fake trading platforms, targeting pensioners in Asia with investment scams. Authorities arrested 365 foreign nationals involved in these schemes.
In Angola, police shut down two illegal cryptocurrency mining centres, arrested nine suspects, and seized over 2,000 mining devices and six illegal power transformation stations. The electrical equipment alone was valued at over $1 million.
Nigerian authorities arrested a suspect behind a phishing and business email compromise (BEC) operation. The suspect allegedly harvested software credentials and collected about 2.1 million email addresses. Another Nigerian case involved investment fraud through messaging apps, with over $2.4 million in suspected proceeds traced, much of it laundered through cryptocurrency.
Other actions included dismantling a malicious mobile loan app scheme in Tanzania, disrupting a vehicle import fraud network in Gabon, and arresting 30 suspects in the Republic of Congo.
The response
Interpol coordinated the operation, providing investigators with intelligence on suspicious domains, IP addresses, and command-and-control infrastructure (servers used by criminals to control compromised machines). Private sector partners like Group-IB, Kaspersky, Fortinet, Team Cymru, and Meta contributed threat intelligence and helped map criminal networks. According to Group-IB, they supplied information on phishing kits, botnets, and social media accounts linked to fraudsters. Team Cymru provided data on suspicious internet infrastructure.
Neal Jetton, Interpol’s director of cybercrime, said the operation shows international cooperation is key to disrupting criminal networks and recovering assets. The operation also received support from TrendAI, Uppsala Security, Cybercrime Atlas, the Global Anti-Scam Alliance, and Zimbabwe’s telecom regulator.
Has this happened before?
Operation Serengeti III builds on earlier Interpol efforts. The original Operation Serengeti in 2024 led to 1,006 arrests and the dismantling of more than 134,000 malicious infrastructures. Operation Serengeti 2.0 in 2025 resulted in 1,209 arrests, the disruption of 11,432 malicious networks, and the recovery of $97.4 million.
What you should do
For individuals and businesses, this operation highlights the importance of being cautious with unsolicited emails, investment offers, and online lending apps. Organisations should monitor for phishing attempts and keep systems updated. If you suspect you are a victim of online fraud, report it to your local authorities and consider contacting cybersecurity professionals for support.
Why it matters
This operation shows the scale of cybercrime in Africa and the value of international cooperation. It also highlights the range of tactics used by criminals, from phishing and business email compromise to illegal cryptocurrency mining. The results may encourage more joint efforts between law enforcement and private cybersecurity firms.
Key points
- Interpol’s operation led to 1,462 arrests across 21 countries.
- Over $105 million in illicit funds was recovered.
- Nearly 66,000 victims of cybercrime were identified.
- Private cybersecurity firms provided key intelligence.
- The operation targeted a wide range of cybercrimes, including phishing, ransomware, and cryptocurrency fraud.
Sources
Help Net Security
Reference
Hackread
Reference
