Operation Serengeti III Disrupts 11,000 Cybercrime Networks, Recovers $105 Million Across Africa
A major international law enforcement effort, **Operation Serengeti III**, has successfully dismantled nearly 11,000 cybercriminal networks and led to the arrest of over 1,400 individuals across 21 African countries. Coordinated by **Interpol**, the operation targeted prevalent threats like Business Email Compromise (BEC), ransomware, and online scams, recovering more than $105 million in illegal funds.

**Operation Serengeti III**, a multi-national initiative, has delivered a significant blow to cybercrime operations spanning the African continent. From June 29 to August 31, law enforcement agencies from 21 countries, supported by private cybersecurity firms, collaborated to identify and disrupt a vast array of illicit digital activities.
### A Coordinated Strike Against Cybercrime
Coordinated by **Interpol**, the operation involved crucial partnerships with private sector entities including **Team Cymru**, **Kaspersky**, **Group-IB**, and **Fortinet**. This collaboration was instrumental in tracking down sophisticated cybercriminal enterprises.
According to a recent press release from **Interpol**, the operation resulted in the arrest of 1,462 suspected cybercriminals and the dismantling of 10,909 malicious networks. The investigation identified 65,929 victims, with estimated financial losses exceeding $385 million, highlighting the scale of the criminal activities targeted.
### Key Disruptions and Arrests
Specific successes include the dismantling of two transnational fraud rings in Uganda, leading to 365 arrests linked to online investment and pension fraud schemes. In Angola, authorities busted illegal cryptocurrency mining centers, arresting nine suspects and seizing over 2,000 mining devices.
A notable arrest in Nigeria involved an individual suspected of orchestrating a large-scale phishing and **Business Email Compromise (BEC)** operation. This individual reportedly harvested software credentials and amassed approximately 2.1 million email addresses, underscoring the pervasive nature of credential theft.
**Interpol** further noted that **Operation Serengeti III** also impacted malicious mobile lending applications, fraudulent vehicle import schemes, and various cryptocurrency investment scams.
### The Role of Private Intelligence
Private cybersecurity firms, particularly **Team Cymru**, provided critical intelligence and technical expertise. Their contributions included vital information on suspicious domains, IP addresses, and Command-and-Control (C2) infrastructure. This data enabled investigators to effectively map criminal networks and identify suspects, demonstrating the power of public-private partnerships in combating cybercrime.
**Jacomo Piccolini**, VP of Global Data Partnerships at **Team Cymru**, emphasized the strategic advantage of their insights: "Our ability to see attacker infrastructure at internet scale gives defenders a fundamentally different starting point. Instead of waiting for an attack and then investigating the damage, we can help expose the networks behind criminal operations and can enable defensive actions."
### Building on Previous Successes
**Operation Serengeti III** builds on the achievements of its predecessors. The first **Operation Serengeti**, conducted between September and October 2024 across 19 African countries, led to 1,006 arrests, the takedown of 134,089 malicious infrastructures, and the recovery of approximately $44 million.
**Operation Serengeti 2.0**, which ran from June to August 2025 and also focused on Africa, resulted in 1,209 arrests, the dismantling of 11,432 malicious infrastructures, and the seizure of $97.4 million. The consistent escalation in arrests and recovered funds across these operations underscores the growing effectiveness of international collaboration against cybercrime.