Interpol announced on Oct. 22 that Operation Serengeti III, a cybercrime sweep across Africa, led to 1,462 arrests and the recovery of more than $105 million in illicit funds. The operation ran from June 29 to Aug. 31, 2026, with law enforcement from 21 countries, and targeted ransomware, business email compromise and online scams. Interpol also reported that 10,909 malicious networks were disrupted.
The day in tech, in one email: TLDR is the daily newsletter with links and TLDRs of the most interesting stories in startups, tech and programming.
We may earn a commission if you sign up.
The 1,462 figure counts arrested suspects, not convicted defendants, and Interpol’s own release says several investigations remain active. Authorities are still working to identify more suspects, trace illicit proceeds and analyze seized digital evidence, so the totals describe a snapshot of a sweep that is not finished. Interpol lists the crime types targeted as cyber-enabled fraud, ransomware, business email compromise, online scams and digital extortion, a mix that spans everything from a single phishing operator to organized call-centre rings run across borders.
The scale of Serengeti III across 21 countries
According to Interpol’s release, datelined Lyon, France, the 21 participating countries were Angola, Benin, Cameroon, Congo, Cote d’Ivoire, DR Congo, Eswatini, Gabon, Gambia, Ghana, Kenya, Mozambique, Nigeria, Rwanda, Senegal, South Africa, Tanzania, Uganda, the United States, Zambia and Zimbabwe. Across that group, authorities identified 65,929 victims and linked the targeted activity to losses of more than $385 million. Before the operation began, investigators from 20 African countries and the United States received intelligence on suspicious domains, IP addresses and command-and-control infrastructure.
Neal Jetton, Interpol’s Director of Cybercrime, said cybercrime networks “operate without regard for borders, exploiting technology to target victims on an unprecedented scale,” and that international cooperation remains one of the most effective tools for disrupting them. The release also points to Interpol’s African Cyber Threat Assessment Report 2026, which notes that artificial intelligence increasingly enables cybercrime in Africa and that cyber-enabled financial losses are rising, the backdrop against which the three Serengeti operations have been organized.
Country results in Uganda, Angola and Nigeria
Uganda produced the largest single haul. Authorities dismantled two transnational fraud rings and arrested 365 foreign nationals, according to Interpol. The groups ran investment and pension fraud aimed at victims across Asia, using a rotating call-centre model, scripted communications, fake trading platforms and fraudulent websites. Uganda’s 365 arrests alone amount to roughly a quarter of the 1,462 total, which shows how concentrated some of the sweep’s results were, though Interpol does not break out the remaining arrests country by country.
In Angola, investigators dismantled two illegal cryptocurrency mining centres, arrested nine suspects and seized more than 2,000 mining devices and six illegal power transformation stations, with the electrical infrastructure valued at over $1 million. Nigeria produced two cases: an arrest over a phishing and business email compromise operation that harvested software credentials and amassed about 2.1 million email addresses, along with the recovery of a luxury vehicle suspected of being bought with criminal proceeds, and a separate investment fraud promoted through messaging apps that moved more than $2.4 million in suspected proceeds, much of it laundered through cryptocurrency. Interpol also listed a dismantled malicious mobile loan scheme in Tanzania, a social media vehicle import fraud network disrupted in Gabon, and 30 suspects arrested in the Republic of Congo.
How the totals compare with earlier Serengeti sweeps
BleepingComputer’s coverage places the results beside the earlier runs. The first Serengeti, in September and October 2024, involved 19 countries and produced 1,006 arrests, with about $44 million recovered and 134,089 malicious infrastructures and networks taken down, according to that outlet. Interpol’s account of Serengeti 2.0 in June to August 2025 lists 18 African countries plus the United Kingdom, 1,209 arrests, $97.4 million recovered and 11,432 malicious online systems dismantled.
Against that record, the third operation posted more arrests and more recovered money than either predecessor, while the network count of 10,909 came in slightly below the 2025 figure of 11,432. The operations are not strictly comparable, since the participating countries, the months covered and the definitions of a disrupted network differ from run to run.
Private partners supplied the infrastructure intelligence
Interpol credits private-sector partners with providing intelligence, technical analysis and operational expertise: Group-IB, Kaspersky, Fortinet, TrendAI, Team Cymru, Uppsala Security, Cybercrime Atlas, Meta, the Global Anti-Scam Alliance and the Postal and Telecommunications Regulatory Authority of Zimbabwe. The operation was co-funded by the GLACY-e project, a joint initiative of the European Union and the Council of Europe.
In a Business Wire release, Team Cymru’s Vice President of Global Data Partnerships, Jacomo Piccolini, said that “Criminals cannot operate without infrastructure.” That release repeats Interpol’s totals and describes the company’s own contribution, noting that the operation gave investigators visibility into attacker infrastructure before arrests began, so it is the vendor’s account rather than independent confirmation of the figures. Readers weighing the $105 million should also keep in mind that recovered funds are a fraction of the more than $385 million in losses Interpol links to the activity, and that recovery does not mean money has been returned to the 65,929 identified victims.
This article was produced with the assistance of AI and reviewed by Morning Overview editors prior to publication.
The day in tech, in one email: Get TLDR →
We may earn a commission if you sign up.
More from Morning Overview
