Threat reportThreat IntelligenceTL-2026-4148
Operation Serengeti III: INTERPOL-coordinated Africa-wide cybercrime crackdown (1,462 arrests, $105M recovered)
Operation Serengeti III (TL-2026-4148), also tracked as Operation Serengeti 3.0, is a medium-severity tracked intrusion set, first published 2026-10-22. It has no confirmed attribution, maps to 6 MITRE ATT&CK techniques (T1566, T1583, T1585.001), and is covered by 9 detection rules and 12 indicators of compromise.
- Severity
- MEDIUMAssessed severity
- CVEs
- 0None referenced
- Techniques
- 6MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 12Indicators of compromise
Key facts for TL-2026-4148
- Threat ID
- TL-2026-4148
- Also known as
- Operation Serengeti 3.0, Serengeti III
- Severity
- MEDIUM
- Status
- MONITORING
- Category
- THREAT_INTEL
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Target sectors
- finance, government administration, individuals, retail, energy
- Target regions
- Africa, Asia, North America
- Detection rules
- 9
- Indicators of compromise
- 12
How Operation Serengeti III works
INTERPOL-coordinated Operation Serengeti III ran from 2026-06-29 to 2026-08-31 across 20 African countries plus the United States, producing 1,462 arrests, 10,909 dismantled malicious networks and over $105 million in recovered funds against an estimated $385 million in victim losses. It targeted ransomware, business email compromise, phishing, investment and pension fraud, mobile loan apps and illegal crypto mining.
Operation Serengeti III is the third annual INTERPOL-coordinated cybercrime sweep in Africa, following Operation Serengeti (2024: 1,006 arrests, about $44 million recovered) and Serengeti 2.0 (2025: 1,209 arrests, about $97.4 million recovered). The 2026 iteration ran from June 29 to August 31, 2026 and involved law enforcement from 20 African countries plus the United States (21 countries). It was announced publicly on 2026-10-22. Results reported by INTERPOL-derived coverage: 1,462 suspects arrested, 10,909 malicious networks and infrastructure dismantled, 65,929 victims identified, an estimated USD 385 million in cumulative victim losses, and over USD 105 million recovered. Several investigations remain open for suspect identification and evidence analysis.
Targeted crime types were online fraud, ransomware, business email compromise (BEC), phishing, online investment and pension scams, digital extortion, cryptocurrency theft and investment fraud, illegal cryptocurrency mining, fraudulent vehicle imports and malicious mobile lending apps. The sources are law-enforcement and press reporting; they name no CVEs, malware families, named threat actors or technical indicators (domains, IPs and C2 servers are mentioned only generically), so this record is a trend and enforcement-context entry rather than an exploit analysis.
Notable country actions: In Uganda, 365 foreign nationals were arrested and two transnational fraud rings dismantled; they ran rotating call centers pushing fake online investment platforms at pensioners. In Angola, 9 suspects were arrested, two illegal crypto mining centers shut down, more than 2,000 mining devices seized, along with six illegal power transformation stations valued above USD 1 million. In Nigeria, a suspect running a large-scale phishing and BEC operation that harvested software credentials and amassed approximately 2.1 million email addresses was arrested and a luxury vehicle recovered; a second Nigerian case involving investment fraud run through messaging apps led to one arrest and traced about USD 2.4 million of cryptocurrency-laundered proceeds. Tanzania dismantled a malicious mobile loan app scheme, Gabon disrupted a social-media vehicle import fraud network, and the Republic of Congo arrested 30 cybercrime suspects. A separate Ghana/Nigeria action reportedly arrested 28 and identified over 100 human trafficking victims.
Private-sector partners reported across sources include Group-IB (intelligence on phishing kits, botnets, threat actors and fraudulent social media accounts, plus crypto investment scam and BEC infrastructure), Team Cymru, Kaspersky, Fortinet and Meta; the GLACY-e project (EU/Council of Europe) is also cited. Defender relevance: confirms continued high-volume BEC, phishing, investment-fraud and ransomware activity originating in or targeting Africa, and the value of infrastructure-level intelligence sharing for takedowns. Severity and status are analyst assignments, not source statements.
MITRE ATT&CK techniques used in TL-2026-4148
Initial Access
Resource Development
T1583 Acquire Infrastructure; T1585.001 Establish Accounts: Social Media Accounts
Reconnaissance
T1589.001 Gather Victim Identity Information: Credentials
Impact
Defense Evasion
Remediation for Operation Serengeti III
Immediate actions
- Enforce DMARC/SPF/DKIM with reject policies and flag look-alike and newly registered sender domains to counter BEC and phishing
- Require out-of-band verification for payment instruction and bank detail changes
- Report fraud promptly to national CERTs, law enforcement and financial institutions to enable fund recall
Workarounds
- Restrict installation of unvetted mobile loan or lending apps on managed devices
- Monitor for anomalous power and compute consumption that may indicate unauthorized crypto mining
Longer-term hardening
- Deploy phishing-resistant MFA to limit the value of harvested credentials
- Run user awareness training on investment, pension and romance-style scams
- Maintain offline, tested backups and ransomware response plans
- Consume shared threat intelligence on phishing kits and fraud infrastructure
Timeline of Operation Serengeti III
- Original Operation Serengeti concluded with 1,006 arrests across 19 African countries and about $44 million recovered
- Operation Serengeti 2.0 announced: 1,209 arrests and about $97.4 million recovered across 18 African countries plus the UK
- Operation Serengeti III begins across 20 African countries and the United States, coordinated by INTERPOL
- Active operational phase of Serengeti III ends with 1,462 arrests and 10,909 malicious networks dismantled
- Group-IB, Team Cymru, Kaspersky, Fortinet and Meta identified as private-sector supporters; several investigations remain open
- INTERPOL results announced: over $105 million recovered, 65,929 victims identified, about $385 million in estimated losses
Sources cited for Operation Serengeti III
- Cybercrime crackdown across Africa leads to 1,462 arrests, $105 million seized
- Authorities disrupt nearly 11,000 cybercrime networks in Africa
- Africa cybercrime crackdown nets 1,462 arrests and over $105 million
- Group-IB supports INTERPOL's Operation Serengeti III, leading to 1,462 arrests across Africa and over USD 105 million recovered
- Team Cymru Supports INTERPOL's Operation Serengeti III, Disrupting Cybercriminal Networks Across Africa
- INTERPOL cybercrime operation recovers $105M as Kenya joins 20 countries
- Operation Serengeti 2.0: INTERPOL nabs 1,209 cybercriminals in Africa, seizes $97M
- Operation Serengeti: INTERPOL arrested 1,006 suspects in 19 African countries
Detection coverage for TL-2026-4148
As of 2026-10-22, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4148 across Splunk SPL, Microsoft KQL and Sigma, covering 12 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.