Operation Serengeti III Disrupts 11,000 Cybercrime Networks in Africa

Law enforcement agencies have made significant strides against cybercrime in Africa through Operation Serengeti III, disrupting nearly 11,000 cybercriminal networks and arresting over 1,400 individuals. This operation, which took place between June 29 and August 31, 2026, was coordinated by Interpol and involved authorities from 21 countries, along with private partners such as Team Cymru, Kaspersky, Group-IB, and Fortinet. The crackdown specifically targeted business email compromise, ransomware, and various online scams.

In a press release, Interpol detailed the results of the operation, noting that it led to the recovery of more than $105 million in illegal funds. A total of 1,462 suspected cybercriminals were arrested, and the operation dismantled 10,909 malicious networks. The investigation uncovered 65,929 victims, with estimated financial losses exceeding $385 million.

In Uganda, authorities dismantled two transnational fraud rings, resulting in the arrest of 365 individuals linked to online investment and pension fraud operations. Additionally, the operation revealed illegal cryptocurrency mining centers in Angola, where nine suspects were arrested and over 2,000 mining devices were seized. In Nigeria, one individual was apprehended for allegedly running a large-scale phishing and business email compromise operation that harvested software credentials and amassed approximately 2.1 million email addresses.

Operation Serengeti III also took action against malicious mobile lending applications, fraudulent vehicle imports, and cryptocurrency investment scams. Team Cymru and other private cybersecurity firms played a crucial role by providing intelligence and technical expertise, including key information on suspicious domains, IP addresses, and command-and-control (C2) infrastructure. This collaboration allowed investigators to map criminal networks and identify suspects more effectively.

Proactive Strategies Against Cybercrime Networks

Jacomo Piccolini, Team Cymru's VP of Global Data Partnerships, emphasized the importance of proactive measures in combating cybercrime, stating, "Our ability to see attacker infrastructure at internet scale gives defenders a fundamentally different starting point. Instead of waiting for an attack and then investigating the damage, we can help expose the networks behind criminal operations and can enable defensive actions."

The Part Nobody Mentioned

The first Operation Serengeti took place across 19 African countries between September and October 2024, resulting in 1,006 arrests and the takedown of 134,089 malicious infrastructures and networks, recovering roughly $44 million. The subsequent Operation Serengeti 2.0, conducted between June and August 2025, led to 1,209 arrests and the dismantling of 11,432 malicious infrastructures, with $97.4 million seized.

The cumulative efforts of these operations highlight the ongoing challenges in addressing cybercrime in Africa and the necessity for international cooperation. As authorities continue to tackle these sophisticated schemes, the impact on victims and the financial losses incurred remain pressing concerns that underline the need for vigilance and robust cybersecurity measures.