Between June 29 and August 31, law enforcement agencies working under Interpol's coordination executed Operation Serengeti III, a multinational effort targeting cybercriminal infrastructure and operators across Africa. The campaign resulted in 1,462 arrests and the dismantling of 10,909 malicious networks, with investigators identifying 65,929 victims and estimating total financial losses at more than $385 million. Authorities recovered over $105 million in illegal funds during the operation.
The operation brought together law enforcement from 21 countries alongside private sector partners including Team Cymru, Kaspersky, Group-IB, and Fortinet. The collaborative approach focused on business email compromise schemes, ransomware operations, and online scams that had victimized individuals and organizations across the region.
Regional enforcement actions
Uganda's authorities achieved notable results by dismantling two transnational fraud rings connected to online investment and pension fraud, leading to 365 arrests. In Angola, nine individuals were apprehended in connection with illegal cryptocurrency mining operations, with law enforcement seizing more than 2,000 mining devices from the facilities.
Nigeria saw the arrest of one suspect accused of orchestrating what authorities described as a large-scale operation. According to Interpol's account, the individual ran "a large-scale phishing and business email compromise operation that harvested software credentials and amassed approximately 2.1 million email addresses."
Beyond these headline cases, Operation Serengeti III also targeted malicious mobile lending applications, fraudulent vehicle import schemes, and cryptocurrency investment scams operating across the continent.
Private sector intelligence support
Cybersecurity firms contributed critical infrastructure intelligence that enabled investigators to map criminal operations. Team Cymru and its partners supplied data on suspicious domains, IP addresses, and command-and-control infrastructure used by threat actors.
Our ability to see attacker infrastructure at internet scale gives defenders a fundamentally different starting point. Instead of waiting for an attack and then investigating the damage, we can help expose the networks behind criminal operations and can enable defensive actions.
Jacomo Piccolini, Team Cymru VP of Global Data Partnerships
Operation Serengeti series track record
Operation Serengeti III represents the third major enforcement campaign in the series. The original Operation Serengeti, conducted across 19 African countries between September and October 2024, produced 1,006 arrests, dismantled 134,089 malicious infrastructures and networks, and recovered approximately $44 million.
Operation Serengeti 2.0, which ran between June and August 2025 and also targeted African cybercrime, resulted in 1,209 arrests, the takedown of 11,432 malicious infrastructures, and the seizure of $97.4 million in criminal proceeds.