INTERPOL's Operation Serengeti III: 1,462 Arrests, $105 Million Recovered, and What It Means for Africa's Cyber Defense
Bottom Line Up Front: INTERPOL announced on October 22, 2026, that Operation Serengeti III, a coordinated sweep across 20 African countries and the United States, produced 1,462 arrests, disrupted 10,909 malicious networks, and recovered more than $105 million in illicit funds. Investigators identified 65,929 victims and tied the networks to losses above $385 million. The operation proves that intelligence-led cooperation works. It also proves that recovery still trails losses by nearly four to one, and that arrests are not convictions.
Picture a rented office floor in Kampala. Rows of desks, headsets, and scripts. The people at the desks are not Ugandan. They are foreign nationals reading from a playbook, calling retirees in Asia, and steering them into investments that do not exist. Ugandan police shut down two such rings this summer and arrested 365 people. That scene, repeated across a continent, is what Operation Serengeti III was built to disrupt.
For readers new to the subject, a "cybercrime crackdown" is not a single raid. It is a weeks-long campaign in which INTERPOL hands national police verified intelligence, such as malicious domains and server addresses, and those police act on it at home. The suspects, the money, and the evidence stay under national law. INTERPOL coordinates; it does not arrest.
What Operation Serengeti III Is, in Plain Terms
Serengeti is INTERPOL's annual Africa-focused cybercrime operation, now in its third year. The 2026 edition ran from June 29 to August 31 and targeted five crime types: cyber-enabled fraud, ransomware, business email compromise (BEC), online scams, and digital extortion.
Before the operation began, INTERPOL supplied investigators with actionable intelligence on suspicious domains, IP addresses, and command-and-control infrastructure, the servers criminals use to direct compromised machines. Private firms including Group-IB, Kaspersky, Fortinet, Team Cymru, and Meta helped identify targets and map networks. The European Union and the Council of Europe co-funded the effort through the GLACY-e project.
The participating countries were Angola, Benin, Cameroon, Congo, Côte d'Ivoire, the Democratic Republic of Congo, Eswatini, Gabon, Gambia, Ghana, Kenya, Mozambique, Nigeria, Rwanda, Senegal, South Africa, Tanzania, Uganda, Zambia, Zimbabwe, and the United States.
The Numbers That Matter
1,462 arrests, up from 1,209 in 2025 and 1,006 in 2024
10,909 malicious networks disrupted
More than $105 million in illicit funds recovered
65,929 victims identified
More than $385 million in losses linked to the networks
Read those last two lines together. For every dollar recovered, roughly $3.67 remained lost. That gap is the most important number in the release, and it is the one most headlines skipped.
Four Cases That Explain the Threat
Uganda: industrial-scale pension fraud. Two transnational rings used a rotating call-center model, scripted pitches, fake trading platforms, and fraudulent websites. The 365 arrested were foreign nationals, and the victims were in Asia. Uganda was the venue, not the market.
Angola: cryptocurrency mining as theft of power. Investigators dismantled two illegal mining centers, arrested nine suspects, and seized more than 2,000 mining devices and six illegal power transformation stations. The electrical infrastructure alone was worth more than $1 million. This is cybercrime that drains a national grid.
Nigeria: credential harvesting at scale. Authorities arrested one suspect behind a phishing and BEC operation that collected software credentials and about 2.1 million email addresses. Investigators recovered a luxury vehicle believed to have been bought with the proceeds. A second Nigerian case, an investment fraud run through messaging apps, led to one arrest and traced more than $2.4 million in suspected proceeds, much of it laundered through cryptocurrency.
Elsewhere: a malicious mobile loan app scheme in Tanzania, a social media vehicle import fraud network in Gabon, and 30 arrests tied to a cybercrime operation in the Republic of Congo.
"Cybercrime networks operate without regard for borders," said Neal Jetton, INTERPOL's Director of Cybercrime, in the announcement.
Why Intelligence Sharing Made the Difference
Three design choices explain why Serengeti keeps producing results.
Intelligence before action. Police received target lists before the operation opened, so arrests were directed rather than opportunistic.
Private sector as a sensor network. Security vendors see malicious infrastructure that no single government can see. Their telemetry became the raw material for warrants.
A continental frame. INTERPOL's African Cyber Threat Assessment Report 2026 found artificial intelligence increasingly enabling cybercrime across the continent. Serengeti III was designed around that finding.
An Analyst's View
A top practitioner would not celebrate yet. Four cautions apply.
First, arrests are not convictions. INTERPOL reported no convictions, and several investigations remain open. The real measure of Serengeti III will be the prosecution rate twelve months from now.
Second, the network counts are not comparable year to year. Serengeti I reported 134,089 infrastructures dismantled; Serengeti 2.0 reported 11,432; Serengeti III reported 10,909. Either the methodology changed or the 2024 figure counted something different. Policymakers should ask which.
Third, the Uganda case is the one to study. It is the African expression of the scam-compound model that has plagued Southeast Asia: foreign operators, local real estate, remote victims. If that model is migrating to Africa, the continent faces a human trafficking problem wrapped inside a fraud problem.
Fourth, Nigeria's two cases are modest in arrest count but telling in method. One suspect held 2.1 million email addresses. The lesson for every business leader reading this is that your staff's inboxes are already on a list somewhere.
The honest scorecard reads: cooperation is working, recovery is not keeping pace, and the criminals are adopting AI faster than most defenders.
What This Means for You
Business leaders: BEC remains the single most expensive threat in this operation. Require out-of-band verification for any payment change, no exceptions for urgency.
Law enforcement and intelligence practitioners: The Serengeti model, intelligence first and raids second, is replicable at the state and municipal level.
Policymakers: Fund the prosecution pipeline, not only the raid. Recovered funds without convictions do not deter.
Cybersecurity and AI professionals: Expect AI-generated phishing and synthetic voices in the next cycle. Train detection on that assumption now.
Conclusion
Operation Serengeti III is the strongest evidence to date that African law enforcement, properly resourced and properly informed, can hit transnational cybercrime at scale. It is also a reminder that $280 million never came back. The next step for any organization is to assume it is already a target and to verify, train, and investigate accordingly.
How OSRS can help. OGUN Security Research and Strategic Consulting provides background and due diligence investigations on employees, vendors, and business partners, BEC and fraud risk assessments, and intelligence briefings on West African and transnational cyber threats. Our team includes retired law enforcement and intelligence officers. Contact us at contact@ogunsecurity.com.
Enjoyed this article? Share it with a colleague and subscribe to our email list for weekly intelligence analysis. Stay informed by following us on Google News, Twitter, and LinkedIn for more exclusive cybersecurity insights and expert analyses.
About the Author
Dr. Sunday Oludare Ogunlana, Founder and CEO of OGUN Security Research and Strategic Consulting LLC, Professor of Cybersecurity, national security scholar, and television commentator.
Comments