Interpol-led Operation Serengeti III disrupts 11,000 cybercrime networks across Africa

Coordinated crackdown across 21 countries arrests 1,460 suspects and recovers $105 million

By LineZotpaper

Published22 October 2026

Read Time2 min

A major international law enforcement operation has disrupted nearly 11,000 cybercriminal networks and resulted in the arrest of more than 1,460 suspects across Africa. Operation Serengeti III, coordinated by Interpol, recovered over $105 million in illegal funds during a two-month campaign targeting business email compromise, ransomware, and online investment scams.

Running between June and August 2026, the operation involved police from 21 African nations supported by private cybersecurity firms including Team Cymru, Kaspersky, Group-IB, and Fortinet. According to Interpol, investigators identified 65,929 victims, with combined financial losses estimated at more than $385 million.

National actions yielded significant results. In Uganda, authorities dismantled two transnational fraud rings and arrested 365 individuals suspected of running online investment and pension fraud operations. In Angola, police arrested nine suspects and seized more than 2,000 devices in a crackdown on illegal cryptocurrency mining centres. A suspected operator of a large-scale phishing and business email compromise campaign was arrested in Nigeria, accused of harvesting credentials from approximately 2.1 million email addresses.

Operation Serengeti III is the third in a series of Interpol-coordinated actions focused on African cybercrime. The first operation, conducted across 19 countries in late 2024, resulted in 1,006 arrests and the recovery of roughly $44 million. The sequel, Operation Serengeti 2.0, ran between June and August 2025, netting 1,209 arrests and seizing $97.4 million.

Private sector partners provided critical intelligence for the takedowns. Team Cymru’s VP of Global Data Partnerships, Jacomo Piccolini, noted the strategic shift the partnership enables. “Our ability to see attacker infrastructure at internet scale gives defenders a fundamentally different starting point,” Piccolini said. “Instead of waiting for an attack and then investigating the damage, we can help expose the networks behind criminal operations and can enable defensive actions.”

Analysis

Why This Matters

The scale of the operation (1,462 arrests, 10,909 networks disrupted) demonstrates growing law enforcement capacity, but the estimated $385 million in losses highlights the immense challenge posed by cybercrime in the region.
The diversity of targets (BEC, crypto mining, mobile lending scams, phishing) shows how cybercriminals are exploiting Africa’s rapidly digitising economy.
The high number of victims (65,929) and the transnational nature of the fraud rings underscore the need for sustained international collaboration.

Background

Interpol launched the Serengeti series in 2024 as a focused response to the surge in cyber-enabled financial crime across Africa. The operations rely on a hybrid model of traditional police work and private-sector threat intelligence. While Africa’s digital infrastructure expands, so does its attractiveness to criminal networks, both domestic and international. The Serengeti operations represent an evolving attempt to build a sustainable law enforcement deterrent on the continent.

Key Perspectives

Law Enforcement (Interpol / National Agencies): The operations validate the model of coordinated, intelligence-led policing. The increasing arrest and recovery tallies across the three Serengeti phases suggest maturing capabilities. However, the gap between losses ($385 million) and recovery ($105 million) indicates the fight is far from won. Private Sector (Team Cymru, Kaspersky, Group-IB, Fortinet): These firms provide the technical backbone, mapping criminal infrastructure at scale. Piccolini’s statement reflects a strategic belief that visibility into attacker networks enables proactive disruption rather than reactive incident response. Critics / Skeptics: High-profile arrests are a visible win, but the sheer volume of criminal networks disrupted may suggest that as fast as networks are taken down, new ones can appear. The long-term impact depends on successful prosecution and asset forfeiture, outcomes that the current data does not measure.

What to Watch

Judicial outcomes: How many of the 1,462 arrests lead to successful prosecutions and convictions.
The next phase: Will Operation Serengeti expand geographically or deepen in focus?
Victim restitution: Whether the $105 million recovered is returned to the 65,929 identified victims.
Adaptation: How criminal groups modify their tactics in response to the takedown of their command and control infrastructure.

Sources

Authorities disrupt nearly 11,000 cybercrime networks in Africa · BleepingComputer

Checked

11 claims in this story checked against 1 source: 7 supported.

Show each claim

SupportedOperation Serengeti III disrupted 11,000 cybercrime networks.BleepingComputer: “dismantling of 10,909 malicious networks”
SupportedInterpol coordinated Operation Serengeti III.BleepingComputer: “Coordinated by Interpol”
SupportedThe operation involved 21 countries.BleepingComputer: “the operation involved authorities from 21 countries”
Partly supportedThe operation arrested 1,460 suspects.BleepingComputer: “Operation Serengeti III has resulted in the arrest of 1,462 suspected cybercriminals”
Partly supportedThe operation recovered $105 million.BleepingComputer: “led to the recovery of more than $105 million in illegal funds”
SupportedThe operation ran between June and August 2026.BleepingComputer: “The action unrolled between June 29 and August 31”
SupportedInvestigators identified 65,929 victims and estimated financial losses at more than $385 million.BleepingComputer: “The investigation identified 65,929 victims and estimated financial losses at more than $385 million.”
Partly supportedIn Uganda, authorities arrested 365 individuals suspected of running online investment and pension fraud operations.BleepingComputer: “In Uganda, law enforcement dismantled two transnational fraud rings and arrested 365 individuals for suspected links to online investment and pension fraud operations.”
SupportedIn Angola, police arrested nine suspects and seized more than 2,000 mining devices.BleepingComputer: “nine suspects have been arrested, and more than 2,000 mining devices have been seized.”
Partly supportedIn Nigeria, a suspected operator was accused of harvesting credentials from approximately 2.1 million email addresses.BleepingComputer: “Authorities also arrested one individual in Nigeria, suspected of running "a large-scale phishing and business email compromise operation that harvested software credentials and amassed approximately 2.1 million email addresses."”
SupportedJacomo Piccolini said: “Our ability to see attacker infrastructure at internet scale gives defenders a fundamentally different starting point. Instead of waiting for an attack and then investigating the damage, we can help expose the networks behind criminal operations and can enable defensive actions.”BleepingComputer: “"Our ability to see attacker infrastructure at internet scale gives defenders a fundamentally different starting point. Instead of waiting for an attack and then investigating the damage, we can help expose the networks behind criminal operations and can enable defensive actions," said Jacomo Piccolini”