Africa's largest coordinated cybercrime operation got bigger this year. INTERPOL says Operation Serengeti III, which ran from 29 June to 31 August, led to 1,462 arrests and the recovery of more than $105 million. Police in 20 African countries and the United States took part, targeting online scams, ransomware, business email compromise and digital extortion.
What police found
- Uganda: two transnational fraud rings broken up and 365 foreign nationals arrested. They ran investment and pension scams aimed at victims in Asia from rotating call centres.
- Angola: two illegal crypto-mining centres shut, nine arrests, and more than 2,000 mining machines seized, with electrical equipment worth over $1 million.
- Nigeria: one arrest over a phishing and email-compromise operation that harvested about 2.1 million email addresses, and another over an investment scam promoted on messaging apps, with over $2.4 million in suspected proceeds traced.
- Tanzania: a malicious mobile loan app scheme dismantled. Gabon: a vehicle import fraud run on social media disrupted. Republic of Congo: 30 arrests.
Bigger every year
The first Serengeti operation in 2024 produced 1,006 arrests and the second, in 2025, 1,209, according to BleepingComputer. Recovered funds rose from about $44 million to $97.4 million and now to more than $105 million.
Private companies supplied much of the intelligence, among them Group-IB, Kaspersky, Fortinet, Team Cymru and Meta. INTERPOL's own African threat assessment for 2026 says AI is increasingly enabling cybercrime on the continent and that losses are rising. Neal Jetton, INTERPOL's director of cybercrime, said international cooperation is one of the most effective tools against these networks. Several investigations are still open.
For businesses, the list of targets is the lesson. Business email compromise, where a criminal poses as a supplier or boss to redirect a payment, sits alongside ransomware at the top of it.
