# Operation Serengeti III: Interpol-coordinated takedown of 10,909 malicious networks across Africa

> Interpol-coordinated Operation Serengeti III (June 29 - August 31, 2026) involved 21 countries and resulted in 1,462 arrests, 10,909 malicious networks dismantled, 65,929 victims identified and over $105 million recovered. It targeted BEC, ransomware, phishing, online scams, investment fraud and malicious mobile loan apps linked to an estimated $385 million in losses.

- **Published:** 2026-10-22T08:40:08Z
- **Last reviewed:** 2026-10-22T08:40:08Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4125
- **ID:** TL-2026-4125
- **Severity:** MEDIUM
- **Category:** THREAT_INTEL
- **Status:** MONITORING
- **Detections:** 9 · **IOCs:** 10 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Operation Serengeti III is the third phase of the Interpol-coordinated African cybercrime enforcement series. It ran from June 29 to August 31, 2026 and involved 20 African countries plus the United States (21 in total). Reported results are 1,462 arrests, 10,909 malicious networks dismantled, 65,929 identified victims, more than $385 million in linked losses and more than $105 million recovered. Targeted crime types were fraud schemes, ransomware, business email compromise (BEC), online scams and digital extortion.

Reported country-level actions: in Uganda, two transnational fraud rings were dismantled and 365 foreign nationals were arrested. They ran rotating call centers with fake trading platforms aimed at pensioners in Asia, and BleepingComputer describes the fraud as online investment and pension fraud. In Angola, two illegal cryptocurrency mining centers were shut down, 9 suspects were arrested, and over 2,000 mining devices and six illegal power transformation stations (valued at over $1M) were seized. In Nigeria, one suspect behind a phishing/BEC operation that harvested 2.1 million email addresses was arrested. A second Nigerian case involved investment fraud run through messaging apps, with one arrest and over $2.4M in suspected proceeds traced through cryptocurrency. Tanzania dismantled a malicious mobile loan app scheme. Gabon disrupted a vehicle import fraud network operating via social media. The Republic of Congo arrested 30 suspects.

Private-sector partners named in the sources are Team Cymru, Kaspersky, Group-IB and Fortinet, and Help Net Security and Team Cymru's release also name Meta. Team Cymru supplied infrastructure intelligence on suspicious domains, IP addresses and command-and-control infrastructure. The sources publish no CVEs, malware family names, threat-actor attribution, or network or file IOCs. The record is a law-enforcement disruption of cybercrime ecosystems, not an exploitation campaign. For context, the earlier phases were Operation Serengeti (2024: 1,006 arrests, 134,089 infrastructures dismantled, $44M recovered) and Serengeti 2.0 (June-August 2025: 1,209 arrests, 11,432 infrastructures dismantled, $97.4M recovered).

## MITRE ATT&CK

- T1589.002 Email Addresses
- T1583 Acquire Infrastructure
- T1566 Phishing
- T1566.003 Spearphishing via Service
- T1657 Financial Theft

## Sources

- [Authorities disrupt nearly 11,000 cybercrime networks in Africa (BleepingComputer)](https://www.bleepingcomputer.com/news/security/authorities-disrupt-nearly-11-000-cybercrime-networks-in-africa/)
- [Africa cybercrime crackdown nets 1,462 arrests and over $105 million (Help Net Security)](https://www.helpnetsecurity.com/2026/10/22/interpol-africa-cybercrime-crackdown-operation-serengeti-iii/)
- [Team Cymru Supports INTERPOL's Operation Serengeti III, Disrupting Cybercriminal Networks Across Africa](https://lifestyle.middletownlifemagazine.com/story/775716/team-cymru-supports-interpols-operation-serengeti-iii-disrupting-cybercriminal-networks-across-africa/)
- [INTERPOL: African authorities dismantle massive cybercrime and fraud networks, recover millions (Serengeti 2.0)](https://www.interpol.int/en/News-and-Events/News/2025/African-authorities-dismantle-massive-cybercrime-and-fraud-networks-recover-millions)
- [Interpol arrests 1,209 in Africa in cybercrime clampdown (The Register)](https://www.theregister.com/2025/08/22/interpol_serengeti_20)
- [Large Interpol Cybercrime Crackdown in Africa Leads to the Arrest of Over 1,200 Suspects (SecurityWeek)](https://www.securityweek.com/large-interpol-cybercrime-crackdown-in-africa-leads-to-the-arrest-of-over-1200-suspects/)
- [INTERPOL Arrests 1,209 Cybercriminals Across 18 African Nations (The Hacker News)](https://thehackernews.com/2025/08/interpol-arrests-1209-cybercriminals.html)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4125