Pierluigi Paganini October 23, 2026

INTERPOL’s Operation Serengeti III led to 1,462 arrests, disrupted 10,909 malicious networks and recovered $105 million across 21 countries.

INTERPOL announced the results of Operation Serengeti III, a multinational cybercrime crackdown that led to 1,462 arrests, disrupted 10,909 malicious networks and recovered more than $105 million in illicit funds. The operation brought together law enforcement agencies from 21 countries between June 29 and August 31, 2026, targeting online fraud, ransomware, business email compromise (BEC), scams and digital extortion.

“One of Africa’s largest cybercrime enforcement operations saw law enforcement agencies from 21 countries arrest 1,462 suspects, disrupt 10,909 malicious networks and recover more than USD 105 million in illicit funds.” reads the agency’s announcement. “Authorities identified 65,929 victims targeted by cybercriminal networks, underscoring the scale and sophistication of today’s digital threats. Financial investigations linked criminal activity to losses exceeding USD 385 million. ”

The scale of the operation is striking. Investigators identified 65,929 victims, while financial investigations linked the criminal activity to losses exceeding $385 million. The figures highlight how cybercrime continues to generate substantial profits by combining technical capabilities with familiar forms of deception.

The results also show why tackling these operations requires more than taking down websites or blocking malicious IP addresses. Investigators need to identify the people behind the infrastructure, follow the money and connect evidence collected across jurisdictions.

Uganda saw one of the largest actions in the operation. Authorities broke up two international fraud networks and arrested 365 foreign nationals suspected of running online investment and pension scams targeting people across Asia.

Investigators found call centres where staff followed prepared scripts to convince victims to invest through fake trading platforms and websites. The scams targeted people who believed they were making legitimate investments, including pensioners. These cases show how criminal groups combine technology with organized social engineering to deceive victims and steal their money.

In Angola, authorities shut down two illegal cryptocurrency mining centres, arrested nine suspects and seized over 2,000 mining devices and six illegal power stations. The electrical equipment was worth more than $1 million.

In Nigeria, investigators arrested a suspect linked to phishing and business email compromise (BEC), which involved stealing software credentials and collecting about 2.1 million email addresses. They also recovered a luxury car suspected of being bought with criminal money.

A separate Nigerian investigation traced over $2.4 million linked to an investment scam promoted through messaging apps, with much of the money laundered through cryptocurrency. Authorities also targeted loan app fraud in Tanzania, vehicle import scams in Gabon and arrested 30 suspects in the Republic of Congo.

Operation Serengeti III relied on intelligence provided before the enforcement phase. Investigators from 20 African countries and the United States received information about suspicious domains, IP addresses and command-and-control infrastructure associated with criminal activity.

Private-sector cybersecurity companies also supported the operation, providing threat intelligence, technical analysis and investigative expertise. INTERPOL listed Group-IB, Kaspersky, Fortinet, TrendAI, Team Cymru, Uppsala Security, Cybercrime Atlas and Meta among the participating partners, alongside other organizations.

This cooperation matters because criminal infrastructure rarely respects national boundaries. A phishing domain, a compromised account, a fraudulent investment platform and the bank accounts used to move stolen funds may all involve different countries and service providers. Investigators need to connect those elements quickly enough to identify suspects and preserve evidence.

INTERPOL’s 2026 African Cyber Threat Assessment Report highlights the growing role of AI in cybercrime as financial losses rise. Criminals can use AI to create convincing messages, improve social engineering and target more victims. While AI does not replace the need for criminal infrastructure or ways to move stolen money, it can make scams easier to repeat and harder for victims to recognize.

INTERPOL said several investigations remain active. Authorities are continuing to identify suspects, trace illicit proceeds and analyze digital evidence recovered during the operation.

That qualification is important. Arrests and infrastructure disruptions are meaningful enforcement results, but they don’t automatically establish how many criminal organizations have been dismantled permanently, how much of the stolen money will reach victims, or whether other operators will rebuild the disrupted services.

“Cybercrime networks operate without regard for borders, exploiting technology to target victims on an unprecedented scale.”  INTERPOL Director of Cybercrime Neal Jetton said.

“Operation Serengeti III reinforces a clear message: while cybercrime is increasingly borderless, international cooperation remains one of the most effective tools for disrupting criminal networks, recovering criminal assets and protecting communities from digital harm.”

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, Operation Serengeti)