INTERPOL's Serengeti III nets 1,462 arrests and $105 million across Africa

An INTERPOL-coordinated crackdown on cybercrime in Africa has led to 1,462 arrests and the takedown of 10,909 malicious networks, according to reports published on October 22 by Help Net Security and BleepingComputer. The operation, dubbed Serengeti III, ran from June 29 to August 31, 2026, and involved police in 21 countries: 20 in Africa plus the United States. Investigators recovered more than $105 million in illicit funds, making it the largest haul of the operation series so far.

What happened

According to Help Net Security, the operation targeted fraud, ransomware, business email compromise (BEC), online scams and digital extortion. Financial investigators linked the dismantled networks to losses above $385 million and identified 65,929 victims.

Before the operation, INTERPOL shared intelligence on suspicious domains, IP addresses and command-and-control servers with participating countries. Private companies Group-IB, Kaspersky, Fortinet, Team Cymru and Meta helped identify targets and map the networks, Help Net Security reported. BleepingComputer said Team Cymru supplied infrastructure intelligence that helped investigators map networks and identify suspects.

Notable cases

The reports describe several country-level actions:

• Uganda: Authorities dismantled two transnational fraud rings and arrested 365 foreign nationals. According to Help Net Security, the rings ran rotating call centers that used scripted pitches, fake trading platforms and fraudulent websites to push pensioners in Asia into nonexistent investments.
• Angola: Investigators shut two illegal cryptocurrency mining centers, arrested nine suspects and seized more than 2,000 mining devices along with six illegal power transformation stations whose equipment was worth over $1 million.
• Nigeria: One suspect behind a phishing and BEC operation was arrested after allegedly harvesting software credentials and amassing about 2.1 million email addresses. In a separate investment fraud case run through messaging apps, investigators traced more than $2.4 million in suspected proceeds, much of it laundered through cryptocurrency.
• Tanzania, Gabon and the Republic of Congo: Police dismantled a malicious mobile loan app scheme, disrupted a vehicle import fraud network on social media and arrested 30 suspects, respectively.

INTERPOL Director of Cybercrime Neal Jetton said international cooperation "remains one of the most effective tools" for disrupting criminal networks and recovering assets, as quoted by Help Net Security.

How it compares

BleepingComputer compared the results with earlier rounds. The first Serengeti operation, in September and October 2024, covered 19 countries, led to 1,006 arrests and recovered about $44 million. Serengeti 2.0, run between June and August 2025, resulted in 1,209 arrests and $97.4 million in recovered funds. Serengeti III exceeds both in arrests and recovered money, although it took down fewer networks than the first round, which dismantled 134,089 pieces of infrastructure.

Why it matters

BEC and investment fraud remain among the costliest forms of cybercrime worldwide, and many of the schemes disrupted in this operation targeted victims outside Africa, including pensioners in Asia. For organizations, the operation is a reminder to verify payment change requests through a separate channel, train staff to recognize BEC lures and report fraud quickly, since rapid reporting increases the chance that funds can be traced and recovered.