Operation Serengeti III: Interpol takes down nearly 11,000 cybercrime networks in Africa

Law enforcement agencies, coordinated by Interpol, have carried out a sweeping crackdown on cybercrime across Africa. Operation Serengeti III dismantled nearly 11,000 malicious networks and led to the arrest of more than 1,400 suspects.

The operation ran from June 29 to August 31 and brought together authorities from 21 countries alongside private partners including Team Cymru, Kaspersky, Group-IB, and Fortinet. According to Interpol, 1,462 suspects were arrested and 10,909 malicious networks were taken down, with more than $105 million in illegal funds recovered.

Investigators identified 65,929 victims, with total financial losses estimated at more than $385 million. The action targeted business email compromise (BEC), ransomware, and online scams.

Across the continent

In Uganda, authorities dismantled two transnational fraud rings and arrested 365 individuals suspected of links to online investment and pension fraud schemes. In Angola, illegal cryptocurrency mining centers were shut down: nine suspects were arrested and more than 2,000 mining devices seized.

In Nigeria, one individual was arrested on suspicion of running a large-scale phishing and business email compromise operation. According to investigators, the suspect harvested credentials and amassed roughly 2.1 million email addresses. The operation also affected malicious mobile lending apps, fraudulent vehicle imports, and cryptocurrency investment scams.

The role of private firms

Team Cymru and other cybersecurity companies supplied intelligence and technical expertise — details on suspicious domains, IP addresses, and command-and-control (C2) infrastructure — helping map the criminal networks. "Our ability to see attacker infrastructure at internet scale gives defenders a fundamentally different starting point," said Jacomo Piccolini, Team Cymru's VP of Global Data Partnerships. Rather than waiting for an attack and then investigating the damage, he said, the firm can help expose the networks behind criminal operations in advance.

A continuing series

Serengeti III builds on earlier rounds. The first operation, conducted across 19 African countries in the autumn of 2024, resulted in 1,006 arrests, the takedown of 134,089 malicious infrastructures, and the recovery of roughly $44 million. Serengeti 2.0, run in the summer of 2025, led to 1,209 arrests, the dismantling of 11,432 infrastructures, and the seizure of $97.4 million.

Source: Bleeping Computer