Interpol's Serengeti III Nets 1,462 Arrests in Africa

Police in 21 countries arrested 1,462 suspects and recovered more than $105m in illicit funds during a two-month push against online fraud, ransomware and extortion across Africa, Interpol said on Thursday. The operation, Serengeti III, also disrupted 10,909 malicious networks, according to the Interpol release.

TSN tracks cybercrime like this on its ransomware and cyber attacks hub.

Investigators identified 65,929 victims and linked the networks to losses of more than $385m, Interpol says. The operation ran from 29 June to 31 August 2026 and targeted cyber-enabled fraud, ransomware, business email compromise, online scams and digital extortion. Twenty African countries took part, along with the United States.

Pension scams, crypto mines and 2.1 million email addresses

The biggest arrest tally Interpol highlights came from Uganda. Authorities there dismantled two transnational fraud rings and arrested 365 foreign nationals linked to online investment and pension schemes aimed at victims across Asia, Interpol says. Investigators found a rotating call-centre model that used scripted conversations, fake trading platforms and fraudulent websites to persuade pensioners to invest in opportunities that did not exist.

In Angola, investigators shut down two illegal cryptocurrency mining centres, arrested nine people and seized more than 2,000 mining devices. They also seized six illegal power transformation stations; that electrical equipment alone was worth more than $1m, according to Interpol. Illegal mining in Angola was also a target last year, when Interpol said authorities closed 25 mining centres and confiscated 45 illicit power stations, along with equipment worth more than $37m.

Nigeria produced two cases. Police arrested a suspect behind a large phishing and business email compromise operation that harvested software credentials and built up about 2.1 million email addresses, and recovered a luxury car thought to have been bought with the proceeds. In a separate investment-fraud case promoted through messaging apps, investigators traced more than $2.4m in suspected criminal proceeds, much of it laundered through cryptocurrency, Interpol says. Nigerian fraud has turned up in TSN’s coverage before, most recently in a US sentencing over spearphishing of tax preparers.

Elsewhere, Tanzanian authorities dismantled a malicious mobile loan app scheme, Gabon disrupted a vehicle-import fraud network run through social media, and police in the Republic of Congo arrested 30 suspects. Several investigations remain open, Interpol says, as officers trace further proceeds and work through seized evidence.

“Operation Serengeti III reinforces a clear message: while cybercrime is increasingly borderless, international cooperation remains one of the most effective tools for disrupting criminal networks, recovering criminal assets and protecting communities from digital harm,” said Neal Jetton, Interpol’s director of cybercrime.

Bigger than last year on arrests, with a different line-up

The operation follows Serengeti 2.0, which Interpol said in August 2025 had led to 1,209 arrests and $97.4m in recoveries across 18 African countries and the UK. This year’s arrest total is about a fifth higher and recoveries are slightly up, although last year’s operation identified more victims, nearly 88,000. Interpol counted 11,432 “malicious infrastructures” dismantled in 2025, against 10,909 “malicious networks” disrupted this time, so those two figures may not measure the same thing.

The partners have changed too. Last year’s operation was funded by the UK’s Foreign, Commonwealth and Development Office; this year’s was co-funded by the GLACY-e project, a joint initiative of the European Union and the Council of Europe, with the US taking part. Private companies again supplied intelligence on suspicious domains, IP addresses and command-and-control servers before the raids. Interpol lists Group-IB, Kaspersky, Fortinet, Team Cymru, Uppsala Security, Cybercrime Atlas, Meta and the Global Anti-Scam Alliance among them, alongside Zimbabwe’s Postal and Telecommunications Regulatory Authority.

Interpol links the operation to its African Cyber Threat Assessment Report 2026, which it says shows artificial intelligence increasingly enabling cybercrime on the continent and financial losses continuing to rise.