INTERPOL disrupts 10,909 cybercrime networks in Africa

INTERPOL announced that a coordinated law enforcement action disrupted 10,909 malicious networks. The operation recovered more than $105 million in illicit funds. Law enforcement agencies from 21 countries arrested 1,462 suspects during the operation. Authorities identified 65,929 victims targeted by the cybercriminal networks. Financial investigations linked the criminal activity to losses exceeding USD 385 million.

Operation Serengeti III took place between June 29 and August 31, 2026. Participating nations included Angola, Benin, Cameroon, Congo, Côte d'Ivoire, Democratic Republic of Congo, Eswatini, Gabon, Gambia, Ghana, Kenya, Mozambique, Nigeria, Rwanda, Senegal, South Africa, Tanzania, Uganda, United States, Zambia, and Zimbabwe. Private-sector partners including Group-IB, Kaspersky, blockchain analytics firm Uppsala Security and Meta supported the operation. Group-IB provided INTERPOL with threat intelligence data on phishing kits, botnets, and other malicious resources hosted in Africa.

Specific actions included the disruption of two transnational fraud rings in Uganda, leading to the arrest of 365 foreign nationals. Two illegal cryptocurrency mining centers were dismantled in Angola, resulting in the arrest of nine suspects. Investigators seized 2,000 cryptocurrency mining devices and six illegal power transformation stations valued at over $1 million in Angola. A suspect was arrested in Nigeria for a large-scale phishing operation that amassed about 2.1 million email addresses. An international investment fraud scheme in Nigeria led to the movement of more than $2.4 million in suspected criminal proceeds. Thirty suspects were arrested linked to a cybercrime operation in the Republic of Congo.

Operation Serengeti III follows two previous waves that took place between September and October 2024, and June and August 2025.