Operation Serengeti III: How INTERPOL’s Africa Sweep Arrested 1,462

WarBrief Live | October 27, 2026 | Cybersecurity

Operation Serengeti III, the INTERPOL-coordinated cybercrime sweep across Africa, arrested 1,462 suspects, disrupted 10,909 malicious networks and recovered more than $105 million in illicit funds, according to INTERPOL’s announcement of the results on October 22, 2026. The operation ran from June 29 to August 31, 2026, and brought together law enforcement agencies from 20 African countries and the United States. It is the third edition of the Serengeti series, and the largest by arrests so far, but it is also a reminder of the gap between enforcement and the scale of the crime: investigators linked the targeted networks to losses exceeding $385 million, so the recovered sum covers roughly a quarter of the losses identified in this operation alone.

What investigators confirmed, and what remains unverified, matters here. The arrests, the disrupted networks, the victim count and the recovery figure are INTERPOL’s reported results, corroborated in independent trade coverage. The people arrested are suspects, not convicted criminals, and INTERPOL has not published charges, court outcomes or a country-by-country breakdown beyond the highlighted cases below. Several investigations remain active, so further arrests, seizures and traced funds are possible, but none of that is confirmed yet.

What happened in Operation Serengeti III?

Between June 29 and August 31, 2026, investigators from the participating countries worked from shared intelligence on suspicious domains, internet addresses and command-and-control infrastructure, the servers criminals use to direct malware and scam operations. INTERPOL says that intelligence was supplied before the operation began, so national police forces could move against known infrastructure rather than starting from individual complaints. Private-sector partners, including Group-IB, Kaspersky, Fortinet, Team Cymru, Uppsala Security, TrendAI, Meta, the Cybercrime Atlas and the Global Anti-Scam Alliance, supplied threat data, technical analysis and operational support. The operation was co-funded by the Global Action on Cybercrime Enhanced (GLACY-e) project, a joint initiative of the European Union and the Council of Europe.

The targets were not a single gang or a single scam. INTERPOL lists cyber-enabled fraud, ransomware, business email compromise (BEC), online scams and digital extortion. That breadth is the point: the same infrastructure, call centres, fake trading platforms, phishing kits and laundering routes serve many fraud types at once. Dismantling a network, in this context, means taking down the domains, servers and accounts that let a scheme operate, not necessarily arresting every person involved. That is why the operation reports two very different kinds of numbers, people arrested and networks disrupted, and why neither number alone describes the other.

The 21 participating countries were Angola, Benin, Cameroon, Congo, Cote d’Ivoire, the Democratic Republic of Congo, Eswatini, Gabon, Gambia, Ghana, Kenya, Mozambique, Nigeria, Rwanda, Senegal, South Africa, Tanzania, Uganda, the United States, Zambia and Zimbabwe. INTERPOL itself does not make arrests; national police forces act under their own laws, and INTERPOL coordinates intelligence and cooperation between them. That distinction also explains the uneven public detail: each country reports what its own cases allow it to disclose, and INTERPOL’s announcement highlights only a handful of national cases.

What is Operation Serengeti III and how does it work?

Operation Serengeti III is a coordinated enforcement operation, not a standing agency or a new law. Its model, now used for the third time, has three stages. First, private partners and INTERPOL analysts map criminal infrastructure: domains registered for phishing, servers hosting fake investment platforms, and the command-and-control systems behind botnets and scam apps. Second, that intelligence is shared with investigators in the participating countries before the operational window, so they can prepare warrants, seizures and arrests under national law. Third, during the window, national forces act in parallel, which makes it harder for a network to simply move its servers to a neighbouring jurisdiction when one country’s police move in.

That model is also why the operation’s headline numbers need careful reading. A disrupted network is an infrastructure takedown, and a single criminal group can run many networks, while a single network can serve many groups. The 10,909 figure should not be read as 10,909 separate gangs. Likewise, the 65,929 identified victims are people investigators could link to the targeted networks during this operation; the true victim count across these crime types is almost certainly higher, because many victims never report, and many cases are never linked to a named operation.

By the numbers: what Serengeti III reported

Metric	Figure	Source
Suspects arrested	1,462 (CONFIRMED)	INTERPOL, October 22, 2026
Malicious networks disrupted	10,909 (CONFIRMED)	INTERPOL, October 22, 2026
Victims identified	65,929 (CONFIRMED)	INTERPOL, October 22, 2026
Illicit funds recovered	More than $105 million (CONFIRMED)	INTERPOL, October 22, 2026
Losses linked to targeted networks	More than $385 million (CONFIRMED)	INTERPOL, October 22, 2026
Uganda arrests	365 foreign nationals (CONFIRMED)	INTERPOL, October 22, 2026
Angola mining devices seized	More than 2,000 (CONFIRMED)	INTERPOL, October 22, 2026
Nigeria phishing email addresses harvested	About 2.1 million (REPORTED)	INTERPOL via trade coverage
Nigeria investment fraud proceeds traced	More than $2.4 million (REPORTED)	INTERPOL via trade coverage
Republic of Congo arrests	30 suspects (REPORTED)	INTERPOL via trade coverage

Caveat: figures marked CONFIRMED appear in INTERPOL’s own announcement and in at least one independent outlet; figures marked REPORTED come from INTERPOL’s announcement as relayed by trade coverage and have not been separately itemised by INTERPOL in a country breakdown.

Where the operation hit hardest: Uganda, Angola and Nigeria

Uganda produced the largest single-country arrest figure in the announcement. Authorities there dismantled two transnational fraud rings and arrested 365 foreign nationals linked to online investment and pension fraud schemes targeting victims across Asia. Investigators described a rotating call-centre model: scripted communications, fake trading platforms and fraudulent websites used to persuade pensioners to invest in opportunities that did not exist. Uganda’s 365 arrests are roughly a quarter of the operation’s total, which says as much about where the call-centre infrastructure was concentrated as about where the victims were, since the victims in these cases were largely in Asia, not in Uganda itself.

In Angola, investigators dismantled two illegal cryptocurrency mining centres, arrested nine suspects and seized more than 2,000 mining devices alongside six illegal power transformation stations. The seized electrical infrastructure alone was valued at more than $1 million. Illegal mining matters to this story for a different reason than fraud: it steals electricity, often at industrial scale, and it converts stolen power into cryptocurrency that can then be moved across borders with little trace. It is a reminder that cybercrime infrastructure is not only digital; it has a physical footprint in power grids, warehouses and hardware.

Nigeria’s cases show two distinct crime types. In one, authorities arrested a suspect behind a large-scale phishing and business email compromise operation that harvested software credentials and amassed approximately 2.1 million email addresses, and recovered a luxury vehicle suspected to have been bought with criminal proceeds. Business email compromise, in which criminals impersonate a boss, supplier or client to redirect a payment, remains one of the costliest cybercrime categories because a single successful email can move a large sum. In a separate Nigerian investigation, an international investment fraud scheme promoted through messaging apps led to another arrest, with financial investigations tracing more than $2.4 million in suspected criminal proceeds, much of it laundered through cryptocurrency transactions.

Elsewhere, the pattern repeats at smaller scale: authorities dismantled a malicious mobile loan application scheme in Tanzania, disrupted a social media-based vehicle import fraud network in Gabon, and arrested 30 suspects linked to a cybercrime operation in the Republic of Congo. None of these cases, on its own, would make international news. Together, they illustrate how the same playbook, a plausible app, a fake listing, a scripted pitch, is adapted to whatever payment system and platform a country’s victims trust most.

Background and timeline: how the Serengeti series grew

Serengeti III did not appear from nowhere. It is the third operation in a series that INTERPOL and African law enforcement agencies have run since 2024, and each edition has grown in arrests and recoveries, even as the counting of disrupted infrastructure has changed in ways that make direct comparison misleading.

• September 2 to October 31, 2024: The first Operation Serengeti, run with AFRIPOL across 19 African countries, arrested 1,006 suspects, identified more than 35,000 victims and was linked to nearly $193 million in losses, with about $44 million recovered according to partner reporting.
• June to August 2025: Serengeti 2.0, involving 18 African countries and the United Kingdom, arrested 1,209 suspects, dismantled 11,432 malicious infrastructures and recovered $97.4 million, identifying nearly 88,000 victims.
• June 29 to August 31, 2026: Operation Serengeti III, involving 20 African countries and the United States, arrested 1,462 suspects, disrupted 10,909 malicious networks, identified 65,929 victims and recovered more than $105 million, with losses linked to the targeted networks exceeding $385 million.
• October 22, 2026: INTERPOL announced the Serengeti III results, noting that several investigations stemming from the operation remain active.

Two cautions apply to that timeline. First, the 2024 infrastructure figure, 134,089, is more than ten times the later figures, and INTERPOL’s releases use different wording across years, “infrastructures and networks”, “infrastructures” and “networks”, without explaining whether the counting method changed. The drop from 134,089 to about 11,000 should not be read as a collapse in criminal activity. Second, the victim counts move in both directions across editions, 35,000, then nearly 88,000, then 65,929, which reflects which cases were in scope each year, not a reliable trend in total victimisation. What is consistent is the direction of arrests and recoveries: up in each edition.

The wider context, from INTERPOL’s African Cyber Threat Assessment Report 2026, is that artificial intelligence is increasingly enabling cybercrime across the continent and that cyber-enabled financial losses continue to rise. AI does not create these scams, but it makes them cheaper to run at scale: convincing phishing emails, scripted call-centre pitches and fake trading platforms can be produced and adapted faster than before, which is one reason enforcement has shifted toward shared infrastructure intelligence rather than chasing individual scam messages.

Why the Serengeti III sweep matters beyond the arrest count

For law enforcement, the operation’s value is less in any single arrest than in the intelligence it generates. Seized devices, domains and financial trails from one country’s cases can identify networks operating in another, and several Serengeti III investigations are still active for exactly that reason. For the private partners, the lesson is similar: Team Cymru, which supported all three Serengeti operations, argues that criminals cannot operate without infrastructure, and that infrastructure, domains, servers, payment routes, leaves traces while it is being built, before victims are harmed. Mapping that infrastructure early is, in that view, the difference between prevention and post-mortem investigation.

For businesses and readers, the practical lesson is narrower and more useful. The scams disrupted here were not exotic zero-day hacks. They were fake investment platforms, pension fraud, phishing emails, business email compromise, malicious loan apps and fake vehicle listings, the same categories that reach ordinary inboxes and messaging apps every day. The defences that blunt them are correspondingly ordinary: verify payment-change requests through a separate channel before transferring money, treat unsolicited investment pitches promising high returns as fraud until proven otherwise, and report suspected fraud to a bank and a national authority promptly, since early reporting improves the odds of recovering funds.

There is also a limit to celebrate honestly. Recovering $105 million from networks linked to $385 million in losses leaves most of the identified losses unrecovered, and the operation says nothing about how or when identified victims will get money back. Arrests disrupt, but they do not automatically dismantle the business model, and scam infrastructure can be rebuilt with new domains and new call centres. Serengeti III is best understood as a large, coordinated disruption of a moving target, not as the end of the networks it targeted. Readers interested in how such takedowns are put together can read our explainer on how cybercrime takedowns work, and our coverage of the earlier KillSec takedown and Operation Confrontation Ghost shows the same pattern in ransomware and large-scale fraud.

Different perspectives on the sweep

INTERPOL’s Director of Cybercrime, Neal Jetton, framed the operation as proof that cooperation works across borders. In a statement quoted by INTERPOL, he said: “Cybercrime networks operate without regard for borders, exploiting technology to target victims on an unprecedented scale.” He added: “Operation Serengeti III reinforces a clear message: while cybercrime is increasingly borderless, international cooperation remains one of the most effective tools for disrupting criminal networks, recovering criminal assets and protecting communities from digital harm.” That is the enforcement case in one paragraph: no single country can police infrastructure that spans continents, so shared intelligence is the precondition for action.

Industry partners make a related but distinct point. Kaspersky, a regular contributor to INTERPOL-coordinated efforts, stresses that the borderless nature of cybercrime makes it impossible for a single organisation or country to confront it alone, and points to shared threat knowledge as the mechanism that turns isolated cases into a map of a network. Team Cymru makes the infrastructure argument: because criminals must build, connect and maintain their systems, those activities create opportunities to find them before an attack lands. Both views support the operation’s method, but neither claims that a single sweep ends the problem.

A more sceptical reading focuses on what the announcement does not say. It names no suspects, lists no charges and reports no convictions, which is normal at this stage but means the public cannot yet judge how many of the 1,462 arrests will lead to prosecutions. It gives no country-by-country breakdown beyond the highlighted cases, so readers cannot tell how much of the recovery came from which jurisdiction. And it does not address restitution: identifying 65,929 victims is not the same as compensating them. Those gaps do not undermine the reported results, but they do mark the boundary between what is confirmed and what is still to be shown.

What the Serengeti III sweep means for US/UK/EU readers

The operation was centred on Africa, but its victims, infrastructure and money flows were not confined there. Uganda’s fraud rings targeted victims in Asia, the United States participated as the one non-African country, and the private partners and co-funding include European institutions and global firms. For readers in the United States, the United Kingdom and the European Union, three consequences follow directly.

First, the scam types disrupted here are the same ones arriving in European and American inboxes: business email compromise aimed at companies, fake investment platforms aimed at savers and pensioners, and phishing campaigns harvesting credentials at scale. A network dismantled in one region does not stay dismantled if its operators can re-register domains elsewhere, so the practical benefit for Western readers is disruption and intelligence, not immunity.

Second, the cryptocurrency thread runs through the operation in both directions. In Angola, illegal mining converted stolen electricity into crypto assets; in Nigeria, suspected fraud proceeds were laundered through crypto transactions. For regulators and banks in the US, UK and EU, that reinforces the case for tracing crypto flows alongside traditional bank transfers, and for treating suspicious mining and laundering infrastructure as part of the same enforcement picture as fraud itself.

Third, the operation’s funding and partnership model, EU and Council of Europe co-funding, global private-sector threat data, and African national enforcement, is a template that Western agencies already use and are likely to reuse. Readers should expect similar joint announcements, with similar headline numbers and similar limits, and should read them the same way: arrests and disrupted networks as a measure of enforcement activity, recoveries against linked losses as a measure of how much harm remains unrepaired.

What to watch next in the Serengeti cases

The most informative next steps will not be new headline numbers but the follow-through on the cases already announced. Watch for prosecutions and court outcomes in the Uganda, Angola and Nigeria cases, since those will show whether arrests convert into convictions and asset forfeiture. Watch for any INTERPOL or national update on restitution, since the announcement is silent on how recovered funds reach victims. Watch for further arrests from the investigations INTERPOL says remain active, and for whether a fourth Serengeti operation is announced for 2027, which would confirm the series as a standing annual effort rather than a one-off sweep. Finally, watch the next African Cyber Threat Assessment for whether AI-enabled crime continues to grow as a share of reported cases, since that trend, more than any single operation, will shape what the next sweep has to target. Our Conflict Zones hub tracks related enforcement and security developments.

Frequently asked questions

What is Operation Serengeti III?
Operation Serengeti III is an INTERPOL-coordinated cybercrime enforcement operation that ran from June 29 to August 31, 2026, across 20 African countries and the United States. It targeted cyber-enabled fraud, ransomware, business email compromise, online scams and digital extortion, and its results were announced on October 22, 2026.

How many people were arrested in Operation Serengeti III?
INTERPOL reported 1,462 suspects arrested. Those arrested are suspects, not convicted criminals, and INTERPOL has not published charges or court outcomes for them. Uganda accounted for 365 of the arrests, the largest single-country figure highlighted in the announcement.

How much money was recovered in Operation Serengeti III?
More than $105 million in illicit funds was recovered. Financial investigations linked the targeted networks to losses exceeding $385 million, so the recovery covers roughly a quarter of the losses identified in this operation. INTERPOL has not said how or when victims will receive recovered funds.

Which countries took part in Operation Serengeti III?
The 21 participating countries were Angola, Benin, Cameroon, Congo, Cote d’Ivoire, the Democratic Republic of Congo, Eswatini, Gabon, Gambia, Ghana, Kenya, Mozambique, Nigeria, Rwanda, Senegal, South Africa, Tanzania, Uganda, the United States, Zambia and Zimbabwe.

Is Operation Serengeti III the first operation of its kind?
No. It is the third in the Serengeti series. The first operation in 2024 arrested 1,006 suspects, and Serengeti 2.0 in 2025 arrested 1,209 suspects. Arrests and recoveries have risen in each edition, although the way disrupted infrastructure was counted changed between years, so those figures should not be compared directly.

Sources

• INTERPOL: Cybercrime crackdown in Africa nets 1,462 arrests, recovers over USD 105 million
• BleepingComputer: Authorities disrupt nearly 11,000 cybercrime networks in Africa
• The Hacker News: INTERPOL Arrests 1,462 Suspects, Disrupts 10,909 Cybercrime Networks in Global Crackdown
• Fortinet: Operation Serengeti: Three Years of Collaboration Against Cybercrime
• Team Cymru: Operation Serengeti: Three Years of Disrupting Cybercrime