Loading story…
INTERPOL-coordinated Operation Serengeti III resulted in 1,462 arrests, the disruption of 10,909 malicious networks, and the recovery or seizure of more than $105 million in illicit assets. Authorities from 20 African countries and the United States conducted the operation from June 29 to August 31, 2026, targeting business email compromise, ransomware, online fraud and digital extortion. Investigators identified 65,929 victims whose estimated losses exceeded $385 million.
National actions included dismantling fraud rings in Uganda, shutting down illegal cryptocurrency-mining facilities in Angola, and disrupting phishing and investment fraud in Nigeria, where authorities arrested a suspected phishing and business email compromise operator. Investigations also targeted criminal schemes in Tanzania, Gabon and the Republic of Congo. Private cybersecurity companies supported the operation with intelligence on suspicious domains, IP addresses and command-and-control infrastructure, helping authorities identify and disrupt criminal networks.
See the reporting duties and controls this puts on the clock.
12 events from the most recent confirmed update back to the earliest known activity.
Nigerian authorities arrested a suspect linked to an operation that harvested software credentials and collected approximately 2.1 million email addresses. Investigators recovered a luxury car believed to have been purchased with criminal proceeds.
Angolan investigators arrested nine suspects and seized more than 2,000 mining devices during Serengeti III. Authorities also seized six illegal power transformation stations, with the electrical equipment valued at more than $1 million.
Ugandan authorities dismantled two fraud rings and arrested 365 foreign nationals during Serengeti III. The groups used rotating call centers, scripted pitches, fake trading platforms, and fraudulent websites to lure pensioners in Asia into nonexistent investments.
Before the operation began, INTERPOL supplied investigators with intelligence on suspicious domains, IP addresses, and command-and-control infrastructure. Group-IB, Kaspersky, Fortinet, Team Cymru, and Meta helped identify targets and map criminal networks.
Authorities in the Republic of Congo arrested 30 suspects linked to a cybercrime operation during Serengeti III.
Authorities in Gabon disrupted a vehicle import fraud network operating on social media during Operation Serengeti III.
Tanzanian authorities dismantled a malicious mobile loan application scheme as part of Operation Serengeti III.
Nigerian investigators arrested one suspect in an investment-fraud scheme promoted through messaging apps. They traced more than $2.4 million in suspected proceeds, much of it laundered through cryptocurrency.
The operation concluded after authorities arrested 1,462 suspects, disrupted 10,909 malicious networks, and recovered or seized more than $105 million in illicit assets. Investigators identified 65,929 victims and linked the networks to estimated losses exceeding $385 million.
INTERPOL coordinated the launch of Operation Serengeti III, targeting fraud, ransomware, business email compromise, online scams, and digital extortion. Police from 20 African countries and the United States participated.
Operation Serengeti 2.0 ran from June to August 2025, targeting cybercrime in Africa. Authorities arrested 1,209 suspects, disrupted 11,432 malicious infrastructure elements, and seized $97.4 million.
The first Operation Serengeti ran across 19 African countries from September to October 2024. Authorities made 1,006 arrests, removed 134,089 malicious infrastructure elements and networks, and recovered or seized approximately $44 million.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See what this changes for your reporting obligations and which controls it puts on the clock.
2 references tracked. Mallory keeps watching after this page renders.
mkd-cirt.mk
Open sourcehelpnetsecurity.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Law enforcement agencies across 19 African countries, coordinated by INTERPOL under Operation Sentinel, arrested 574 suspects and recovered approximately $3 million in a sweeping crackdown on cybercrime. The month-long operation targeted business email compromise (BEC), digital extortion, and ransomware, resulting in the takedown of over 6,000 malicious links and the decryption of six ransomware variants. Notable incidents included the prevention of a $7.9 million BEC fraud at a Senegalese petroleum company, a ransomware attack on a Ghanaian financial institution that encrypted 100 terabytes of data, and the dismantling of a cross-border scam in Ghana and Nigeria that defrauded over 200 victims. Authorities also seized more than 100 digital devices, took down 30 servers, and shut down thousands of scam-linked social media accounts, with total financial losses from investigated cases exceeding $21 million. The operation highlighted the increasing scale and sophistication of cyberattacks targeting critical sectors such as finance and energy across Africa. International cooperation and rapid response were key to the operation's success, with support from private sector partners including Team Cymru, The Shadowserver Foundation, Trend Micro, TRM Labs, and Uppsala Security. The results demonstrate a strong commitment by African law enforcement and their international partners to combat cybercrime and protect digital infrastructure in the region.
Dec 22, 2025
**INTERPOL’s Operation Red Card 2.0**, coordinated under the **African Joint Operation against Cybercrime (AFJOC)**, resulted in **651 arrests** across **16 African countries** and the recovery of **over $4.3 million** tied to online scam activity. The operation ran from **December 8, 2025 to January 30, 2026**, identified **1,247 victims**, and targeted criminal activity linked to **over $45 million** in losses, including **high-yield investment fraud**, **mobile money fraud**, and **fraudulent mobile loan applications**. Law enforcement reported significant disruption activity, including the seizure of **2,341 devices** and takedowns of **1,442 malicious IPs/domains/servers (and related infrastructure)**. Notable actions included Nigeria dismantling an investment-fraud ring that leveraged **phishing, identity theft, and social engineering** (with **1,000+ fraudulent social media accounts** removed) and arresting **six suspects** accused of breaching a major telecom provider using **compromised staff credentials** to steal airtime/data for resale; Kenya arrested **27 suspects** tied to social-media/messaging-driven fraud schemes; and Côte d’Ivoire arrested **58 suspects** linked to predatory loan-app activity with hidden fees and abusive collection practices.
Feb 18, 2026
INTERPOL said **Operation First Light 2026** led to **5,811 arrests** across **97 countries and territories** and the seizure or interception of **$293 million** in illicit assets during a four-month crackdown on social engineering fraud and related money laundering. The campaign, conducted between January 15 and April 30, targeted **business email compromise**, impersonation fraud, romance scams, investment scams, sextortion, and the financial networks used to move criminal proceeds. Investigators reviewed roughly **150,000 cases**, identified more than **142,000 victims**, blocked **31,014 bank accounts**, and identified **15,606 additional suspects** beyond those arrested. INTERPOL said the operation used its **I-GRIP** payment-intervention system to help stop suspicious transfers involving both fiat currency and virtual assets before settlement, with support from partners including **ASEANAPOL**, **GCCPOL**, and **Europol**. Authorities highlighted cases in **Eswatini**, **Thailand**, **Singapore and Oman**, **Macao, China**, and **Palau**, including impersonation scams, romance-scam laundering through cryptocurrency cross-chain swaps, a business email compromise investigation, and scam centres operating from hotels. The operation was funded in part by China’s Ministry of Public Security and adds to a broader series of INTERPOL-led anti-cybercrime actions such as **Synergia**, **Serengeti**, **Africa Cyber Surge**, **Red Card 2.0**, and **Synergia III**.
Jul 9, 2026