Operation Serengeti III disrupts African cybercrime rings, nets 1,462 arrests

Organisations operating in or with Africa face reduced immediate threat from specific criminal infrastructure following Operation Serengeti III. This INTERPOL-coordinated sweep involved police from 21 countries, including the United States. The operation targeted networks responsible for significant financial harm. According to Help Net Security, authorities dismantled 10,909 malicious networks. This disruption affects entities targeted by fraud, ransomware and business email compromise schemes originating from the region.

Which specific criminal activities were disrupted?

Investigators linked the dismantled networks to a wide range of cybercrimes. Help Net Security reports that victims suffered from fraud, ransomware, business email compromise, online scams and digital extortion. In Uganda, authorities broke up rings using fake trading platforms to target pensioners in Asia. In Angola, illegal cryptocurrency mining centres were shut down. Nigerian suspects were tied to phishing operations that harvested credentials and redirected payments.

How much financial damage was attributed to these groups?

The scale of financial impact is substantial, though recovery remains partial. Investigators tied the networks to losses exceeding $385 million. During the operation, which ran from 29 June to 31 August 2026, authorities recovered more than $105 million in illicit funds. In Nigeria, one case traced over $2.4 million in suspected proceeds laundered through cryptocurrency. Another Nigerian suspect had a luxury car seized, believed to be bought with scam proceeds.

Who assisted in identifying these targets?

Law enforcement relied on private sector intelligence to map the criminal infrastructure. Before the operation began, INTERPOL provided data on suspicious domains, IP addresses and command-and-control servers. Help Net Security notes that private firms including Group-IB, Kaspersky, Fortinet, Team Cymru and Meta helped identify targets. This collaboration allowed police to locate physical assets, such as the 2,000 mining devices seized in Angola.

What does this mean for ongoing security risks?

While 1,462 arrests represent a significant disruption, cybercrime networks are resilient and often reconstitute. The operation covered 20 African nations and the US, highlighting the transnational nature of these threats. Specific schemes, such as the mobile loan app fraud in Tanzania and vehicle import scams in Gabon, were dismantled. However, the presence of 65,929 identified victims suggests widespread exposure. Organisations must assume that other untargeted networks remain active.

What affected people can do

Teams usually advise reviewing recent financial transactions for unauthorised transfers, particularly those initiated via email instructions. Users should check whether their credentials have been exposed on public breach databases. Employees must verify the authenticity of any urgent payment requests or investment opportunities, especially those involving cryptocurrency or foreign platforms. Look for follow-up scams where criminals claim to be refunding victims or offer fake security patches. Report suspicious communications to internal security channels immediately.

Background: Business email compromise

Check for subtle urgency, mismatched sender details, and unusual payment requests. Verify all financial changes via a secondary channel like a phone call. Isolate suspicious accounts immediately and review recent OAuth authorisations for hidden access.

Read the full guide: Spot Business Email Compromise: Hidden Signs and Immediate Response

What to do and how to stay safe: INTERPOL

• Monitor corporate bank accounts and payment gateways for unusual outflows or changes to beneficiary details.
• Enforce strict verification procedures for any request involving financial transfers, regardless of the sender's apparent identity.
• Audit email logs for signs of business email compromise, such as unexpected forwarding rules or credential harvesting attempts.
• Review access logs for command-and-control infrastructure connections if your network was previously compromised.

Step-by-step guide: How Password Managers Work: The Cryptography Behind Secure Storage

General security guidance from the Phish Herald newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

How many victims were identified in Operation Serengeti III?

Investigators identified 65,929 victims of fraud, ransomware, business email compromise, online scams and digital extortion.

Which countries participated in the operation?

Police from 21 countries participated, including 20 African nations and the United States.

What was the total value of losses linked to the dismantled networks?

Financial investigators tied the networks to losses exceeding $385 million.