INTERPOL on Thursday announced that a coordinated law enforcement action has disrupted 10,909 malicious networks and recovered more than $105 million in illicit funds.
In tandem, the effort saw law enforcement agencies from 21 countries arrest 1,462 suspects. Codenamed Operation Serengeti III, the cybercrime crackdown took place between June 29 and August 31, 2026.
“Authorities identified 65,929 victims targeted by cybercriminal networks, underscoring the scale and sophistication of today’s digital threats,” INTERPOL said in a statement. “Financial investigations linked criminal activity to losses exceeding USD 385 million.”
Participating nations included Angola, Benin, Cameroon, Congo, Côte d’Ivoire, Democratic Republic of Congo, Eswatini, Gabon, Gambia, Ghana, Kenya, Mozambique, Nigeria, Rwanda, Senegal, South Africa, Tanzania, Uganda, United States, Zambia, and Zimbabwe.
Group-IB, which was one of the many private sector partners, said it provided INTERPOL with threat intelligence data on phishing kits, botnets, and other malicious resources hosted in Africa or used to conduct cyber attacks targeting the region.
“Criminals cannot operate without infrastructure. They have to build it, connect it and maintain it, and those activities create opportunities to find them,” said Jacomo Piccolini, vice president of Global Data Partnerships at Team Cymru.
“Instead of waiting for an attack and then investigating the damage, we can help expose the networks behind criminal operations and enable defensive actions. Operation Serengeti III demonstrates the real-world impact of putting that intelligence in the hands of law enforcement.”
Some of the key operational highlights are listed below –
- Disruption of two transnational fraud rings and the arrest of 365 foreign nationals in Uganda linked to sophisticated online investment and pension fraud schemes targeting victims across Asia.
- Dismantling of two illegal cryptocurrency mining centers and the arrest of nine suspects in Angola, along with the seizure of 2,000 cryptocurrency mining devices and six illegal power transformation stations valued at over $1 million.
- Arrest of a suspect in Nigeria in connection with a large-scale phishing and business email compromise operation that collected software credentials and amassed about 2.1 million email addresses.
- Arrest of another suspect in Nigeria for operating an international investment fraud scheme advertised via messaging apps. The operation led to the movement of more than $2.4 million in suspected criminal proceeds, with a huge chunk of the funds laundered through cryptocurrency transactions.
- Arrest of 30 suspects linked to a cybercrime operation in the Republic of Congo.
Operation Serengeti III follows two previous waves that took place between September and October 2024, and June and August 2025, leading to more than 2,000 arrests.
“Cybercrime networks operate without regard for borders, exploiting technology to target victims on an unprecedented scale,” Neal Jetton, INTERPOL’s director of cybercrime, said.
“Operation Serengeti III reinforces a clear message: while cybercrime is increasingly borderless, international cooperation remains one of the most effective tools for disrupting criminal networks, recovering criminal assets and protecting communities from digital harm.”
