INTERPOL says a coordinated crackdown on African cybercrime ended with 1,462 suspects arrested and 10,909 malicious networks disrupted. The operation, named Serengeti III, ran from June 29 to Aug. 31, 2026, and the agency announced the totals on Oct. 22. Those are the figures behind the reported totals of nearly 11,000 networks and more than 1,400 arrests, though the arrests are of suspects and say nothing yet about convictions.
Tech news in one quick read: Get the most interesting stories in startups, tech and programming, each with a short TLDR, in one daily email from TLDR.
We may earn a commission if you sign up.
INTERPOL also reported that more than USD 105 million in illicit funds was recovered, that 65,929 victims were identified, and that the activity investigators traced was linked to losses above USD 385 million. Several investigations that grew out of the operation remain open, so the totals describe a snapshot of work still under way rather than a closed set of cases. INTERPOL also pointed to its African Cyber Threat Assessment Report 2026, which links artificial intelligence to a growing share of cybercrime on the continent and to rising financial losses, as the backdrop for the sweep.
What INTERPOL counted and who took part
According to INTERPOL’s announcement, law enforcement from 21 countries took part: Angola, Benin, Cameroon, Congo, Cote d’Ivoire, the Democratic Republic of Congo, Eswatini, Gabon, Gambia, Ghana, Kenya, Mozambique, Nigeria, Rwanda, Senegal, South Africa, Tanzania, Uganda, the United States, Zambia and Zimbabwe. The targets were cyber-enabled fraud, ransomware, business email compromise, online scams and digital extortion. Before the operation began, investigators from 20 African countries and the United States received intelligence on suspicious domains, IP addresses and command-and-control infrastructure.
Neal Jetton, INTERPOL’s Director of Cybercrime, said in the release: “Cybercrime networks operate without regard for borders, exploiting technology to target victims on an unprecedented scale.” He added that international cooperation remains one of the most effective tools for disrupting such networks. The wording matters for those numbers, because a “network” in these tallies covers malicious infrastructure as well as groups of people, which is why the network count is more than seven times the arrest count.
The country cases behind the totals
Uganda produced the largest single arrest figure. Authorities there dismantled two transnational fraud rings and arrested 365 foreign nationals, whom INTERPOL describes as running online investment and pension fraud against victims across Asia using rotating call centers, scripted conversations, fake trading platforms and fraudulent websites. That one action accounts for about a quarter of all arrests in the operation.
In Angola, investigators dismantled two illegal cryptocurrency mining centers, arrested nine suspects, seized more than 2,000 mining devices and shut down six illegal power transformation stations, with the electrical equipment alone valued at over USD 1 million. Nigeria reported two single-suspect arrests. One was a phishing and business email compromise operation that harvested software credentials and amassed about 2.1 million email addresses; the other was an international investment fraud promoted through messaging apps, through which more than USD 2.4 million in suspected proceeds moved, much of it laundered through cryptocurrency.
Smaller actions filled out the picture, and they show how varied the targets were, from consumer lending apps on phones to imported cars sold through social media posts. Tanzania dismantled a malicious mobile loan app scheme, Gabon disrupted a social media-based vehicle import fraud network, and the Republic of Congo arrested 30 suspects linked to a cybercrime operation, according to the same release. INTERPOL’s release gives no further breakdown for those three actions, so the size of the Tanzanian scheme and the basis for the Congo arrests are not public.
Private partners and the earlier Serengeti rounds
INTERPOL credits private-sector partners with intelligence, technical analysis and operational expertise: Group-IB, Kaspersky, Fortinet, TrendAI, Team Cymru, Uppsala Security, Cybercrime Atlas, Meta and the Global Anti-Scam Alliance, with support from Zimbabwe’s Postal and Telecommunications Regulatory Authority and co-funding from the EU and Council of Europe’s GLACY-e project. Team Cymru’s own statement quotes Jacomo Piccolini, its vice president of global data partnerships, saying criminals cannot operate without infrastructure and that investigators cannot disrupt what they cannot see.
BleepingComputer, which reported the results on Oct. 22, put the operation in sequence. The first Serengeti ran in September and October 2024 across 19 African countries, and that round produced 1,006 arrests, 134,089 malicious infrastructures and networks taken down, and about USD 44 million recovered. Serengeti 2.0, in June through August 2025, ended with 1,209 arrests, 11,432 malicious infrastructures dismantled and USD 97.4 million seized.
Read against those predecessors, Serengeti III has the highest arrest count of the three and the largest recovery, but a network count below both the 11,432 of the 2025 round and the 134,089 of the first, so the trend is not uniformly upward. The figures also come from the organizers, with no independent audit, and INTERPOL’s release does not say how many of the 1,462 people have been charged, let alone convicted. Court outcomes in Uganda, Nigeria and the other countries involved will determine how much of the haul becomes lasting prosecutions. For now, the verified claim is limited to what INTERPOL and its partners reported: a large number of suspects detained, a large body of infrastructure disrupted and a sizable sum recovered across 21 countries over two months.
This article was produced with the assistance of AI and reviewed by Morning Overview editors prior to publication.
Tech news in one quick read: Subscribe to TLDR →
We may earn a commission if you sign up.
More from Morning Overview
- Lake Powell sank to a record 3,517 feet, nearing the level that stops Glen Canyon Dam’s turbines
- Seven of Earth’s nine planetary boundaries are breached, and all seven are worsening
- The NSA says three phone features should be off whenever you aren’t using them
- Hurricane Hunter radar shows four warning signs that a tropical cyclone is about to strengthen, a University of Miami study found
