During an international cybercrime operation coordinated across 21 countries, INTERPOL has arrested 1,462 suspects and disrupted 10,909 malicious networks. Operation Serengeti III also resulted in the recovery of more than $105 million in illicit funds.
During the crackdown, which took place between June 29 and August 31, 2026, ransomware, online scams, business email compromises, digital extortion and other cyber-enabled financial crimes were targeted. An investigation conducted by INTERPOL identified 65,929 victims connected to criminal networks. Financial investigations indicated that an amount of $385 million was lost as a result of the activity.
Law enforcement agencies from Nigeria, Uganda, Angola, Kenya, South Africa, Ghana, Tanzania, and the Democratic Republic of Congo were involved in the operation along with the United States and other participating nations.
The private sector also contributed intelligence on threat intelligence and criminal infrastructure, and Group-IB, one of the participating private-sector partners, provided information about phishing kits, botnets and malicious resources that were hosted in Africa or targeted at the region. This information provided investigators with information about infrastructure supporting cyberattacks and the individuals responsible for operating them.
Fraud Networks and Illegal Crypto Mining Targeted
Authorities in Uganda detained 365 foreign nationals suspected of being connected to two transnational fraud networks, which was one of the largest arrest figures in the operation. A number of online investment schemes and pension scams targeting Asia were linked to these groups.
Investigators discovered schemes which involved call centres, fraudulent websites, and fake trading platforms, attempting to persuade victims to invest in unreal projects. Several illegal cryptocurrency mining facilities in Angola have been dismantled and nine suspects have been arrested.
Investigators have seized over 2,000 cryptocurrency mining devices and six illegal power transformation stations. Approximately $1 million was spent on electrical equipment, which underscores the substantial infrastructure and resources involved in these illegal mining operations. The investigation also included Nigeria, where authorities arrested a suspect allegedly implicated in an extensive phishing and business email compromise operation.
According to the report, the activity involved the collection of software credentials as well as approximately 2.1 million email addresses. A separate case involved the arrest of another Nigerian suspect related to international investment fraud schemes promoted using messaging applications. The investigation identified a total of more than $2.4 million in suspected criminal proceeds, of which a substantial portion was reportedly laundered by cryptocurrency exchanges.
INTERPOL Warns of Rising AI-Enabled Cybercrime in Africa
An increase in concerns over the changing cyber threat landscape across Africa has led to this operation. According to Interpol's African Cyber Threat Assessment Report 2026, artificial intelligence is increasingly being used in cybercrime as well as the number of financial losses resulting from digital crimes continues to rise.
In advance of Operation Serengeti III, investigators from 20 African countries and the United States received information regarding suspicious domains, IP addresses, and command-and-control infrastructure associated with criminal activity. In addition to identifying malicious resources, tracing connections between criminal networks, and targeting suspected perpetrators, these details also helped authorities identify suspicious individuals.
A number of private-sector companies were involved in the operation, including Group-IB, Kaspersky, Fortinet, TrendAI, Team Cymru, Uppsala Security and Meta, which provided threat intelligence, technical analysis and investigative expertise. Additionally, the initiative was supported by the Global Anti-Scam Alliance, Cybercrime Atlas and Zimbabwe’s Postal and Telecommunications Regulatory Authority.
The Director of Cybercrime for INTERPOL, Neal Jetton, noted that international cooperation is imperative as criminal organizations continue to operate across international borders and use technology to target victims in greater numbers. By conducting coordinated investigations, we were able to disrupt these networks, recover criminal assets, and reduce the damage caused by cybercrime.
A number of investigations associated with the crackdown remain ongoing. Authorities continue to investigate digital evidence seized, trace suspected criminal proceeds, and identify additional individuals associated with these networks. During the previous phases of Serengeti III in September and October 2024, as well as June and August 2025, more than 2,000 arrests were made.
Further highlighting the importance of cross-border intelligence sharing and cooperation between law enforcement agencies and cybersecurity firms, the latest operation demonstrates how organized crime can be combatted through cross-border intelligence sharing and cooperation.
