INTERPOL says a multinational cybercrime operation across Africa arrested 1,462 suspects, disrupted 10,909 malicious networks and recovered more than $105 million in illicit funds. Operation Serengeti III ran from June 29 through August 31, with agencies from 21 countries targeting cyber-enabled fraud, ransomware, business email compromise, online scams and digital extortion.
The operation identified 65,929 victims and linked the criminal activity to losses exceeding $385 million, according to INTERPOL. Investigators received intelligence on suspicious domains, IP addresses and command-and-control infrastructure before enforcement activity began, helping national agencies identify targets and map networks.
Authorities reported varied schemes rather than a single malware campaign. In Uganda, police dismantled two transnational fraud rings that used rotating call centers, scripted communications, fake trading platforms and fraudulent websites to target pensioners and other victims across Asia; 365 foreign nationals were arrested. In Nigeria, investigators arrested a suspect in a phishing and business email compromise operation that harvested software credentials and collected about 2.1 million email addresses.
Other cases included two illegal cryptocurrency-mining centers dismantled in Angola, where authorities seized more than 2,000 mining devices and six power-transformation stations. Nigerian investigators also pursued an investment-fraud scheme promoted through messaging applications, tracing more than $2.4 million in suspected proceeds, much of it laundered through cryptocurrency transactions. Authorities in Tanzania and Gabon separately disrupted a malicious mobile-loan application scheme and a social-media vehicle-import fraud network.
The results underscore the operational value of combining infrastructure intelligence with local investigative and financial capabilities, but they do not represent a vulnerability disclosure or a single exploitable software flaw. No CVE, public proof of concept or exploitation-in-the-wild claim was identified in INTERPOL’s account. Defenders should therefore focus on the attack patterns described: enforce phishing-resistant multifactor authentication, protect credentials and email accounts, monitor suspicious domains and command-and-control traffic, and scrutinize unsolicited investment and loan offers.
INTERPOL said several investigations remain active. Participating agencies are continuing to identify additional suspects, trace illicit proceeds and analyze seized digital evidence, meaning the operation’s arrest and recovery totals could change as cases progress.
