Law enforcement agencies have disrupted nearly 11,000 cybercriminal networks and arrested more than 1,400 people in Operation Serengeti III, which targeted business email compromise, ransomware, and online scams.
Coordinated by Interpol, the operation involved authorities from 21 countries and private partners like Team Cymru, Kaspersky, Group-IB, and Fortinet, in a major crackdown on cybercrime across Africa.
The action unrolled between June 29 and August 31 and led to the recovery of more than $105 million in illegal funds.
In a press release today, Interpol says that Operation Serengeti III has resulted in the arrest of 1,462 suspected cybercriminals and the dismantling of 10,909 malicious networks.
The investigation identified 65,929 victims and estimated financial losses at more than $385 million.
In Uganda, law enforcement dismantled two transnational fraud rings and arrested 365 individuals for suspected links to online investment and pension fraud operations.
Another highlight of the operation are illegal cryptocurrency mining centers in Angola, where nine suspects have been arrested, and more than 2,000 mining devices have been seized.
Authorities also arrested one individual in Nigeria, suspected of running "a large-scale phishing and business email compromise operation that harvested software credentials and amassed approximately 2.1 million email addresses."
Interpol notes that Operation Serengeti III actions also impacted malicious mobile lending applications, fraudulent vehicle imports, and cryptocurrency investment scams.
Team Cymru and other private cybersecurity firms supported the operation by providing intelligence and technical expertise, including key information on suspicious domains, IP addresses, and command-and-control (C2) infrastructure, helping investigators map criminal networks and identify suspects.
"Our ability to see attacker infrastructure at internet scale gives defenders a fundamentally different starting point. Instead of waiting for an attack and then investigating the damage, we can help expose the networks behind criminal operations and can enable defensive actions," said Jacomo Piccolini, Team Cymru's VP of Global Data Partnerships.
The first Operation Serengeti, conducted across 19 African countries between September and October 2024, resulted in 1,006 arrests, the takedown of 134,089 malicious infrastructures and networks, and the recovery of roughly $44 million.
Operation Serengeti 2.0, conducted between June and August 2025 and also focused on Africa, resulted in 1,209 arrests, the dismantling of 11,432 malicious infrastructures, and the seizure of $97.4 million.
Once attackers have valid credentials, only 37% of their actions are blocked
Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply.
The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments.