Law enforcement agencies from 21 countries have arrested 1,462 people and disrupted 10,909 malicious networks in Operation Serengeti III, an Interpol-coordinated crackdown on business email compromise, ransomware and online scams. BleepingComputer reports that the operation ran from 29 June to 31 August and resulted in the recovery of more than US$105 million in illicit funds.
Interpol announced the results in a press release, stating that investigators identified 65,929 victims and put estimated financial losses across the affected schemes at more than US$385 million. Private-sector partners including Team Cymru, Kaspersky, Group-IB and Fortinet supported the operation with intelligence and technical expertise, covering suspicious domains, IP addresses, and command-and-control infrastructure.
Country-level highlights
In Uganda, authorities dismantled two transnational fraud rings and arrested 365 individuals suspected of involvement in online investment and pension fraud. In Nigeria, one suspect was arrested for allegedly running a phishing and business email compromise operation that, according to Interpol, collected software credentials and built a database of approximately 2.1 million email addresses.
Angola produced a separate strand of the investigation focused on cryptocurrency mining. Nine suspects were arrested and more than 2,000 mining devices seized. Interpol also noted that the operation touched fraudulent mobile lending applications, vehicle import fraud and cryptocurrency investment scams.
Jacomo Piccolini, Team Cymru’s VP of Global Data Partnerships, explained the firm’s contribution: ‘Our ability to see attacker infrastructure at internet scale gives defenders a fundamentally different starting point. Instead of waiting for an attack and then investigating the damage, we can help expose the networks behind criminal operations and can enable defensive actions.’
How the series compares across iterations
The third instalment follows two earlier phases. The first, which spanned 19 African countries during September and October 2024, yielded 1,006 arrests, the dismantling of 134,089 malicious infrastructures and networks, and the recovery of around US$44 million.
The second phase, Operation Serengeti 2.0, ran between June and August 2025 across 18 African nations and the United Kingdom, according to Trend Micro, which supported that iteration with threat intelligence and infrastructure mapping. It led to 1,209 arrests, brought down 11,432 malicious infrastructures, and saw US$97.4 million seized. In August 2025, an Interpol press release on that phase also noted the dismantling of 25 cryptocurrency mining centres in Angola, where 60 Chinese nationals were illegally validating blockchain transactions, and the confiscation of 45 illicit power stations along with mining and IT equipment worth more than US$37 million, equipment the Angolan government earmarked to support power distribution in vulnerable areas.
