Operation Serengeti III Disrupts 10,909 Cybercrime Networks Across Africa

Law enforcement authorities have arrested 1,462 people and disrupted 10,909 malicious cybercrime networks across Africa in Operation Serengeti III, an international crackdown targeting business email compromise, ransomware and online fraud.

Coordinated by Interpol, the operation involved authorities from 21 countries and private-sector partners including Team Cymru, Kaspersky, Group-IB and Fortinet.

Operation recovers more than $105 million in illicit funds

The investigation was conducted from June 29 to August 31 and led to the recovery of more than $105 million in illicit funds, according to Interpol.

Authorities identified 65,929 victims and estimated the total economic losses linked to the criminal activity at more than $385 million.

Uganda, Angola and Nigeria cases

In Uganda, law enforcement agencies dismantled two cross-border fraud rings and arrested 365 people accused of involvement in online investment and pension fraud schemes.

In Angola, authorities arrested nine suspects and seized more than 2,000 mining devices at an illegal cryptocurrency mining center.

Nigerian authorities also arrested an individual accused of operating a large-scale phishing and business email compromise campaign. The operation allegedly harvested software credentials and collected approximately 2.1 million email addresses.

Interpol said Operation Serengeti III also targeted malicious mobile lending applications, fraudulent vehicle imports and virtual currency investment fraud.

Cybersecurity companies provide intelligence on criminal networks

Team Cymru and other private cybersecurity companies supported the operation by providing intelligence and technical expertise. This included information about suspicious domains, IP addresses and command-and-control (C2) infrastructure, helping investigators map criminal networks and identify suspects.

“Our ability to understand an attacker’s infrastructure at Internet scale gives defenders a fundamentally different starting point. Rather than waiting for an attack to investigate the damage, we can expose the networks behind criminal activity and enable defensive measures,” said Giacomo Piccolini, Vice President of Global Data Partnerships at Team Cymru.

Operation Serengeti results continue to grow

The first Operation Serengeti, conducted in 19 African countries from September to October 2024, resulted in the arrest of 1,006 people, the destruction of 134,089 malicious infrastructures and networks, and the recovery of approximately $44 million.

Operation Serengeti 2.0, which ran from June to August 2025 and also targeted Africa, resulted in the arrest of 1,209 people, the dismantling of 11,432 pieces of malicious infrastructure and the seizure of $97.4 million.

The overall prevention score can hide what happens after the initial access. If an attacker uses valid credentials, your defenses drop sharply.

The Blue Report 2026 measures defense techniques by technology across 338 million simulations run in customer production environments.

Get the report