Overview
Law enforcement agencies from 21 countries have disrupted 10,909 malicious networks and arrested 1,462 suspected cybercriminals in Operation Serengeti III, an Interpol-coordinated action against business email compromise (BEC), ransomware and online scams across Africa. The operation ran from June 29 to August 31, 2026, and was reported on October 22.
Operation Results
| Metric | Result |
|---|---|
| Participating countries | 21 |
| Suspects arrested | 1,462 |
| Malicious networks dismantled | 10,909 |
| Victims identified | 65,929 |
| Estimated losses | More than $385 million |
| Funds recovered | More than $105 million |
Private-sector partners included Team Cymru, Kaspersky, Group-IB and Fortinet. Team Cymru supplied intelligence on suspicious domains, IP addresses and command-and-control infrastructure to help map criminal networks and identify suspects.
Notable National Actions
- Uganda: Two transnational fraud rings were dismantled and 365 people arrested over suspected online investment and pension fraud.
- Angola: Authorities uncovered illegal cryptocurrency mining centers, arrested nine suspects and seized more than 2,000 mining devices.
- Nigeria: One suspect was arrested for an alleged phishing and BEC operation that harvested software credentials and built a list of about 2.1 million email addresses.
Other targets included malicious mobile lending apps, fraudulent vehicle imports and cryptocurrency investment scams.
Comparison With Earlier Operations
| Operation | Period | Arrests | Infrastructure or networks taken down | Funds recovered |
|---|---|---|---|---|
| Serengeti | Sep–Oct 2024 (19 countries) | 1,006 | 134,089 | About $44 million |
| Serengeti 2.0 | Jun–Aug 2025 | 1,209 | 11,432 | $97.4 million |
| Serengeti III | Jun 29–Aug 31, 2026 | 1,462 | 10,909 | More than $105 million |
Arrests and recovered funds have grown with each edition, while the count of dismantled networks is far below the first operation's figure.
Why It Matters
BEC and investment fraud remain among the costliest cybercrime categories, and the operation shows how much of that activity is organized into repeatable networks that can be mapped through shared infrastructure intelligence. Public-private data sharing, as with Team Cymru's contribution here, is what allows the scale of these takedowns.
Recommended Actions
- Enforce out-of-band verification for payment changes and wire requests to blunt BEC.
- Require phishing-resistant MFA on email and finance systems.
- Report fraud promptly to your bank and national authority. Early reporting improves the odds of fund recovery.
- Train staff on investment, pension and mobile-lending scam patterns.