Threat reportThreat IntelligenceTL-2026-4125
Operation Serengeti III: Interpol-coordinated takedown of 10,909 malicious networks across Africa
Operation Serengeti III (TL-2026-4125), also tracked as Serengeti III, is a medium-severity tracked intrusion set, first published 2026-10-22. It has no confirmed attribution, affects Various Businesses, financial institutions and individuals in Africa, maps to 5 MITRE ATT&CK techniques (T1566, T1566.003, T1583), and is covered by 9 detection rules and 10 indicators of compromise.
- Severity
- MEDIUMAssessed severity
- CVEs
- 0None referenced
- Techniques
- 5MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 10Indicators of compromise
Key facts for TL-2026-4125
- Threat ID
- TL-2026-4125
- Also known as
- Serengeti III, Operation Serengeti 3.0
- Severity
- MEDIUM
- Status
- MONITORING
- Category
- THREAT_INTEL
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Target sectors
- finance, government administration, retail, telecoms, general public
- Target regions
- Africa, Asia
- Detection rules
- 9
- Indicators of compromise
- 10
Malware and tooling in Operation Serengeti III
Malware and tooling: Unnamed ransomware operations
How Operation Serengeti III works
Interpol-coordinated Operation Serengeti III (June 29 - August 31, 2026) involved 21 countries and resulted in 1,462 arrests, 10,909 malicious networks dismantled, 65,929 victims identified and over $105 million recovered. It targeted BEC, ransomware, phishing, online scams, investment fraud and malicious mobile loan apps linked to an estimated $385 million in losses.
Operation Serengeti III is the third phase of the Interpol-coordinated African cybercrime enforcement series. It ran from June 29 to August 31, 2026 and involved 20 African countries plus the United States (21 in total). Reported results are 1,462 arrests, 10,909 malicious networks dismantled, 65,929 identified victims, more than $385 million in linked losses and more than $105 million recovered. Targeted crime types were fraud schemes, ransomware, business email compromise (BEC), online scams and digital extortion.
Reported country-level actions: in Uganda, two transnational fraud rings were dismantled and 365 foreign nationals were arrested. They ran rotating call centers with fake trading platforms aimed at pensioners in Asia, and BleepingComputer describes the fraud as online investment and pension fraud. In Angola, two illegal cryptocurrency mining centers were shut down, 9 suspects were arrested, and over 2,000 mining devices and six illegal power transformation stations (valued at over $1M) were seized. In Nigeria, one suspect behind a phishing/BEC operation that harvested 2.1 million email addresses was arrested. A second Nigerian case involved investment fraud run through messaging apps, with one arrest and over $2.4M in suspected proceeds traced through cryptocurrency. Tanzania dismantled a malicious mobile loan app scheme. Gabon disrupted a vehicle import fraud network operating via social media. The Republic of Congo arrested 30 suspects.
Private-sector partners named in the sources are Team Cymru, Kaspersky, Group-IB and Fortinet, and Help Net Security and Team Cymru's release also name Meta. Team Cymru supplied infrastructure intelligence on suspicious domains, IP addresses and command-and-control infrastructure. The sources publish no CVEs, malware family names, threat-actor attribution, or network or file IOCs. The record is a law-enforcement disruption of cybercrime ecosystems, not an exploitation campaign. For context, the earlier phases were Operation Serengeti (2024: 1,006 arrests, 134,089 infrastructures dismantled, $44M recovered) and Serengeti 2.0 (June-August 2025: 1,209 arrests, 11,432 infrastructures dismantled, $97.4M recovered).
MITRE ATT&CK techniques used in TL-2026-4125
Initial Access
T1566 Phishing; T1566.003 Spearphishing via Service
Resource Development
Reconnaissance
Impact
Affected products and versions in Operation Serengeti III
- Various — Businesses, financial institutions and individuals in Africa and Asia targeted by BEC, ransomware, phishing and investment fraud
Remediation for Operation Serengeti III
Immediate actions
- Brief finance and AP teams on BEC payment-redirection and invoice-fraud red flags; require out-of-band verification of bank-detail changes
- Block and report phishing domains and sender infrastructure through existing email security and threat-intel feeds
- Warn employees and customers about fake trading platforms, messaging-app investment pitches and unsolicited loan apps
Workarounds
- Restrict mobile app installs to managed or official stores on corporate devices
- Report suspected fraud or BEC losses promptly to law enforcement so funds can be frozen
Longer-term hardening
- Enforce phishing-resistant MFA on email and financial systems to limit BEC account takeover
- Maintain tested offline backups and a ransomware incident response plan
- Share fraud and infrastructure indicators with national CERTs, law enforcement and sector ISACs
Timeline of Operation Serengeti III
- The first Operation Serengeti phase began, reported as 1,006 arrests, 134,089 infrastructures dismantled and $44M recovered.
- The first Operation Serengeti phase (September 2 - October 31, 2024) ended across 19 African countries, with over 35,000 victims identified and nearly $193M in linked losses.
- Operation Serengeti 2.0 (June-August 2025) results were reported: 1,209 arrests, 11,432 malicious infrastructures dismantled and $97.4M recovered.
- Within the operational window, Uganda dismantled two transnational fraud rings and arrested 365 foreign nationals; Angola shut two crypto mining centers (9 arrests); Republic of Congo arrested 30 suspects; Tanzania and Gabon disrupted mobile loan app and vehicle import fraud schemes (exact dates not published).
- Operation Serengeti III began, coordinated by INTERPOL across 21 countries (20 African nations plus the United States).
- Operation Serengeti III operational phase ended with 1,462 arrests, 10,909 malicious networks dismantled, 65,929 victims identified and over $105M recovered.
- INTERPOL Director of Cybercrime Neal Jetton and Team Cymru's Jacomo Piccolini commented on the results; Team Cymru said it supplied internet-scale infrastructure visibility on suspicious domains, IPs and C2 infrastructure.
- Results were publicly reported by BleepingComputer, Help Net Security and Team Cymru, with linked losses estimated at over $385 million.
Sources cited for Operation Serengeti III
- Authorities disrupt nearly 11,000 cybercrime networks in Africa (BleepingComputer)
- Africa cybercrime crackdown nets 1,462 arrests and over $105 million (Help Net Security)
- Team Cymru Supports INTERPOL's Operation Serengeti III, Disrupting Cybercriminal Networks Across Africa
- INTERPOL: African authorities dismantle massive cybercrime and fraud networks, recover millions (Serengeti 2.0)
- Interpol arrests 1,209 in Africa in cybercrime clampdown (The Register)
- Large Interpol Cybercrime Crackdown in Africa Leads to the Arrest of Over 1,200 Suspects (SecurityWeek)
- INTERPOL Arrests 1,209 Cybercriminals Across 18 African Nations (The Hacker News)
Detection coverage for TL-2026-4125
As of 2026-10-22, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4125 across Splunk SPL, Microsoft KQL and Sigma, covering 10 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.