Operation Serengeti III Leads to Over 1,400 Arrests and $105 Million Recovered

A two-month operation across Africa has led to the arrests of 1,462 cybercrime suspects in 20 African countries and the United States, recovering $105 million in stolen funds and shutting down nearly 11,000 malicious networks.

Dubbed Operation Serengeti III, this third annual crackdown aimed to dismantle groups involved in ransomware, phishing, and cyber-enabled fraud, according to Interpol. The operation built on previous efforts, which resulted in 1,006 arrests in the original Operation Serengeti and 1,209 arrests in last year’s Operation Serengeti 2.0.

Neal Jetton, director for cybercrime at Interpol, noted that the increase in arrests indicates a maturation in investigative practices and collaboration among national law enforcement partners. He stated, “Rising arrest figures reflect stronger enforcement activity, not a change in the scale of offending.” Jetton emphasized that the effectiveness of law enforcement should be measured by the reduction in victimization over time rather than the number of arrests made.

The operation comes as cybercriminals in the region are becoming increasingly sophisticated. A survey of 36 African countries revealed that 72% have identified criminally operated scam centers, with over half of cybercrime cases involving the use of artificial intelligence (AI). According to Interpol’s “African Cyberthreat Assessment Report 2026,” 8% of cases frequently and 47% occasionally utilized AI.

Jacomo Piccolini, vice president of global data partnerships at Team Cymru, highlighted the rapid advancements in cybercriminal infrastructure. He remarked, “Scams that once looked like individual schemes now run like businesses, with recruitment pipelines, international staff, and, increasingly, trafficked workers.”

Busting Transnational Criminal Organizations

In Uganda, two transnational criminal organizations employed a rotating call-center model, using scripted communications and fraudulent websites to deceive elderly victims in Asia into investing in financial scams. Ugandan authorities dismantled these fraud rings, arresting 365 foreign nationals, primarily from various Asian countries.

In another part of the operation, police in Angola arrested nine suspects, shutting down two illegal cryptocurrency mining sites and seizing over 2,000 devices used for mining, along with six illegal power transformers valued at over $1 million. Jetton noted that cryptocurrency is a common method for cashing out from illegal schemes.

In Nigeria, law enforcement shut down two fraud operations: one that used 2.1 million email addresses for a large-scale phishing and business email compromise (BEC) scheme, and another focused on international investment fraud that generated at least $2.4 million in profits. These operations underscored the role of AI in facilitating cybercriminal activities.

Jetton explained that the phishing and BEC campaigns utilized AI to scrape information from platforms like LinkedIn, enabling the creation of highly personalized phishing emails that mimicked the writing styles of executives and colleagues. He added that AI also helped manage and prioritize millions of email addresses for large-scale campaigns.

Maturing Collaboration Between Law Enforcement

The collaboration among law enforcement agencies has enhanced their effectiveness in tackling transnational cybercrime. With international partners, countries can gather intelligence on signs of cybercriminal activities within their borders. Piccolini stated that the biggest change since Operation Serengeti 2.0 is the timing of investigations, with teams entering operations armed with intelligence on suspicious IP addresses and domains.

Without such collaboration, transnational criminal organizations could evade justice, especially if their activities primarily targeted citizens of other nations. Piccolini noted that actors targeting victims in Europe and North America often use infrastructure spread across multiple jurisdictions, complicating enforcement efforts.

Both Interpol and Team Cymru confirmed that multiple operations are ongoing, with investigators continuing to utilize seized data and other information to pursue suspected cybercriminals.

Source: Dark Reading