Operation Serengeti III, an international cybercrime crackdown coordinated by INTERPOL, resulted in 1,462 arrests across Africa, the disruption of 10,909 malicious networks and the recovery of more than USD 105 million in illicit funds. Group-IB supported the operation by providing threat intelligence on malicious infrastructure and suspected cybercriminals.

Conducted between June 29 and August 31, 2026, the operation brought together law enforcement agencies from 21 countries. Authorities identified 65,929 victims and linked criminal activities to financial losses exceeding USD 385 million.

The multinational initiative targeted cyber-enabled fraud, ransomware, business email compromise (BEC), online scams and digital extortion.

As part of its contribution, Group-IB shared intelligence with INTERPOL on malicious infrastructure, including phishing kits, botnets and other resources hosted in Africa or used to launch cyberattacks targeting the region. The company also provided information about threat actors involved in fraudulent activities, including social media accounts linked to suspected fraudsters.

The operation comes amid an evolving cyber threat landscape across Africa. According to INTERPOL’s African Cyber Threat Assessment Report 2026, artificial intelligence is increasingly enabling cybercriminal activities, while financial losses linked to cybercrime continue to rise. These developments highlight the importance of intelligence sharing and cooperation between law enforcement agencies and private-sector cybersecurity companies.

The operation resulted in enforcement actions across several countries, targeting different forms of cybercrime.

In Uganda, authorities dismantled two transnational fraud rings and arrested 365 foreign nationals linked to online investment and pension fraud schemes targeting victims across Asia. Investigators uncovered a rotating call-center model that used scripted communications, fraudulent trading platforms and fake websites to persuade victims to invest in nonexistent opportunities.

Meanwhile, authorities in Angola dismantled two illegal cryptocurrency mining centers and arrested nine suspects. They seized more than 2,000 cryptocurrency mining devices and six illegal power transformation stations. The seized electrical infrastructure alone was valued at more than USD 1 million.

In Nigeria, authorities arrested a suspect linked to a large-scale phishing and business email compromise operation. The operation had collected approximately 2.1 million email addresses and harvested software credentials.

A separate investigation targeted an international investment fraud scheme promoted through messaging applications. Investigators traced more than USD 2.4 million in suspected criminal proceeds, much of which had been laundered through cryptocurrency transactions.

Elsewhere, authorities dismantled a malicious mobile loan application scheme in Tanzania and disrupted a social media-based vehicle import fraud network in Gabon. In the Republic of Congo, 30 suspects were arrested in connection with a cybercrime operation.

Several investigations remain ongoing as authorities work to identify additional suspects, trace illicit proceeds and analyze digital evidence gathered during the operation.

Commenting on the initiative, Dmitry Volkov, CEO of Group-IB, said cybercriminal networks continue to operate across borders, exploiting digital platforms and increasingly sophisticated techniques to target individuals and businesses worldwide.

He highlighted the importance of sustained cooperation between law enforcement and the private sector. By combining investigative expertise, actionable threat intelligence and coordinated international efforts, authorities can identify criminal networks, disrupt their activities and prevent further harm, he said.

Neal Jetton, Director of Cybercrime at INTERPOL, also stressed the importance of international cooperation in addressing cross-border cybercrime. He noted that although cybercriminal networks increasingly operate without geographical boundaries, collaboration remains an effective tool for disrupting criminal operations, recovering assets and protecting communities from digital harm.

Operation Serengeti III builds on earlier editions of the multinational initiative. In 2025, Operation Serengeti 2.0, also supported by Group-IB, resulted in 1,209 arrests, the disruption of 11,432 malicious networks and the recovery of USD 97.4 million.

During that operation, Group-IB contributed intelligence on cryptocurrency investment scams, business email compromise infrastructure and malicious infrastructure operating across Africa. The company also provided practical training for investigators.

Through its continued support for Operation Serengeti III, Group-IB is contributing to international law enforcement efforts through intelligence sharing, investigative assistance and capacity building aimed at combating digital crime.

Related post

View all