Interpol-led Operation Serengeti III disrupts nearly 11,000 cybercrime networks in Africa

Past-week coverage · Original source published 2026-10-22.

Interpol says a coordinated law enforcement operation across Africa disrupted nearly 11,000 cybercriminal networks and led to more than 1,400 arrests. Operation Serengeti III ran from June 29 to August 31 and involved authorities from 21 countries, with support from private partners including Team Cymru, Kaspersky, Group-IB and Fortinet.

According to Interpol, the operation resulted in 1,462 arrests and the dismantling of 10,909 malicious networks. Investigators identified 65,929 victims and estimated financial losses at more than $385 million, while authorities recovered more than $105 million in illegal funds.

The operation targeted business email compromise, ransomware and online scams. In Uganda, police dismantled two transnational fraud rings and arrested 365 people over suspected links to online investment and pension fraud. In Angola, nine suspects were arrested and more than 2,000 mining devices seized at illegal cryptocurrency mining centers. In Nigeria, one person was arrested on suspicion of running a large-scale phishing and business email compromise operation that Interpol says harvested software credentials and amassed roughly 2.1 million email addresses.

Interpol said the action also affected malicious mobile lending apps, fraudulent vehicle imports and cryptocurrency investment scams. Private firms contributed intelligence on suspicious domains, IP addresses and command-and-control infrastructure.

For defenders, the case is a reminder that credential theft and email compromise remain core enablers of fraud at scale. Organizations should treat leaked or harvested credentials as a live risk, tighten email authentication and monitoring, and review account access for signs of misuse.