INTERPOL operation disrupts 10,909 cybercrime networks
INTERPOL has announced that Operation Serengeti III disrupted 10,909 malicious networks, recovered more than $105 million in illicit funds and resulted in the arrest of 1,462 suspects. The coordinated cybercrime operation involved law-enforcement agencies in 21 countries and ran from June 29 to August 31, 2026.
The operation identified 65,929 victims targeted by cybercriminal networks. Financial investigations linked the activity under review to losses exceeding $385 million, illustrating the scale of fraud and other digital crime pursued during the campaign.
Cross-border action targets criminal infrastructure
Participating countries were Angola, Benin, Cameroon, Congo, Côte d’Ivoire, the Democratic Republic of Congo, Eswatini, Gabon, Gambia, Ghana, Kenya, Mozambique, Nigeria, Rwanda, Senegal, South Africa, Tanzania, Uganda, the United States, Zambia and Zimbabwe.
INTERPOL said the campaign focused on networks that operate across borders and use technology to reach victims at scale. Neal Jetton, INTERPOL’s director of cybercrime, said international cooperation remains an effective means of disrupting criminal networks, recovering criminal assets and protecting communities from digital harm.
Private-sector partners also contributed to the effort. Group-IB provided INTERPOL with threat-intelligence data on phishing kits, botnets and other malicious resources hosted in Africa or used to target the region. Team Cymru’s Jacomo Piccolini noted that criminals depend on infrastructure they must build, connect and maintain, creating opportunities to identify the networks behind their operations.
Fraud, phishing and illicit mining cases
In Uganda, authorities disrupted two transnational fraud rings and arrested 365 foreign nationals allegedly connected to online investment and pension fraud schemes targeting victims across Asia.
Angolan authorities dismantled two illegal cryptocurrency-mining centres, arrested nine suspects and seized 2,000 mining devices. They also seized six illegal power transformation stations valued at more than $1 million.
In Nigeria, one suspect was arrested in connection with a large-scale phishing and business email compromise operation that collected software credentials and accumulated about 2.1 million email addresses. A separate arrest concerned an international investment-fraud scheme promoted through messaging applications; the case involved movement of more than $2.4 million in suspected criminal proceeds, much of it laundered through cryptocurrency transactions.
Authorities in the Republic of Congo also arrested 30 suspects linked to a cybercrime operation. Operation Serengeti III follows campaigns held from September to October 2024 and from June to August 2025, which together produced more than 2,000 arrests.
Business implication
For businesses, the operation reinforces the value of preserving actionable evidence on phishing, credential theft, payment fraud and suspicious infrastructure, then sharing it promptly through appropriate law-enforcement and incident-response channels. Cross-border schemes can combine email compromise, messaging-app fraud and cryptocurrency laundering, so fraud and security teams need coordinated reporting and investigation processes.