A coordinated law enforcement operation across 21 countries disrupted 10,909 malicious networks, led to 1,462 arrests and recovered more than $105 million, according to INTERPOL figures reported by The Hacker News.
Operation Serengeti III ran from June 29 to August 31, 2026. Authorities also identified 65,929 people targeted by criminal networks, while financial investigations linked the investigated activity to losses exceeding USD 385 million.
Those figures describe different measures. The $105 million represents recovered funds, while the USD 385 million concerns losses linked to criminal activity. The 65,929 figure counts identified targets, not necessarily people who incurred a confirmed financial loss.
Fraud rings, phishing operations and illicit cryptomining targeted
Participating authorities reported several operational outcomes:
- Uganda: Police disrupted two transnational fraud rings and arrested 365 foreign nationals. The groups allegedly operated online investment and pension schemes aimed at victims across Asia.
- Angola: Authorities dismantled two illegal cryptocurrency mining centers and arrested nine suspects. They seized 2,000 mining devices and six illegal power transformation stations, with the seized equipment valued at more than $1 million.
- Nigeria: One suspect was arrested over a large phishing and business email compromise operation. Investigators said it collected software credentials and accumulated approximately 2.1 million email addresses.
- Nigeria: A separate arrest concerned an international investment fraud promoted through messaging applications. More than $2.4 million in suspected criminal proceeds moved through the scheme, with a large proportion allegedly laundered using cryptocurrency transactions.
- Republic of Congo: Authorities arrested 30 suspects in connection with a cybercrime operation.
The announced results are operational totals rather than a detailed accounting of the harm experienced by each identified target. For example, the 2.1 million email addresses associated with the Nigerian phishing case should not be interpreted as 2.1 million victims or confirmed compromised accounts.
Intelligence sharing supported the cross-border action
The operation involved Angola, Benin, Cameroon, Congo, Côte d'Ivoire, the Democratic Republic of Congo, Eswatini, Gabon, Gambia, Ghana, Kenya, Mozambique, Nigeria, Rwanda, Senegal, South Africa, Tanzania, Uganda, the United States, Zambia and Zimbabwe.
Private-sector partners included Group-IB and Team Cymru. Group-IB said it supplied intelligence concerning phishing kits, botnets and other malicious infrastructure either hosted in Africa or used to attack targets in the region.
Jacomo Piccolini, Team Cymru’s vice president of global data partnerships, said the infrastructure required to operate criminal networks creates opportunities to locate and expose them. INTERPOL Cybercrime Director Neal Jetton similarly presented international cooperation as central to disrupting cross-border operations, recovering assets and protecting targeted communities.
Operation Serengeti III followed two previous waves conducted from September to October 2024 and from June to August 2025. Those earlier operations resulted in more than 2,000 arrests combined; that total is separate from the 1,462 arrests reported for the latest action.
