# Operation Serengeti III: INTERPOL-coordinated Africa-wide cybercrime crackdown (1,462 arrests, $105M recovered)

> INTERPOL-coordinated Operation Serengeti III ran from 2026-06-29 to 2026-08-31 across 20 African countries plus the United States, producing 1,462 arrests, 10,909 dismantled malicious networks and over $105 million in recovered funds against an estimated $385 million in victim losses. It targeted ransomware, business email compromise, phishing, investment and pension fraud, mobile loan apps and illegal crypto mining.

- **Published:** 2026-10-22T13:49:54Z
- **Last reviewed:** 2026-10-22T13:49:54Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4148
- **ID:** TL-2026-4148
- **Severity:** MEDIUM
- **Category:** THREAT_INTEL
- **Status:** MONITORING
- **Detections:** 9 · **IOCs:** 12 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Operation Serengeti III is the third annual INTERPOL-coordinated cybercrime sweep in Africa, following Operation Serengeti (2024: 1,006 arrests, about $44 million recovered) and Serengeti 2.0 (2025: 1,209 arrests, about $97.4 million recovered). The 2026 iteration ran from June 29 to August 31, 2026 and involved law enforcement from 20 African countries plus the United States (21 countries). It was announced publicly on 2026-10-22. Results reported by INTERPOL-derived coverage: 1,462 suspects arrested, 10,909 malicious networks and infrastructure dismantled, 65,929 victims identified, an estimated USD 385 million in cumulative victim losses, and over USD 105 million recovered. Several investigations remain open for suspect identification and evidence analysis.

Targeted crime types were online fraud, ransomware, business email compromise (BEC), phishing, online investment and pension scams, digital extortion, cryptocurrency theft and investment fraud, illegal cryptocurrency mining, fraudulent vehicle imports and malicious mobile lending apps. The sources are law-enforcement and press reporting; they name no CVEs, malware families, named threat actors or technical indicators (domains, IPs and C2 servers are mentioned only generically), so this record is a trend and enforcement-context entry rather than an exploit analysis.

Notable country actions: In Uganda, 365 foreign nationals were arrested and two transnational fraud rings dismantled; they ran rotating call centers pushing fake online investment platforms at pensioners. In Angola, 9 suspects were arrested, two illegal crypto mining centers shut down, more than 2,000 mining devices seized, along with six illegal power transformation stations valued above USD 1 million. In Nigeria, a suspect running a large-scale phishing and BEC operation that harvested software credentials and amassed approximately 2.1 million email addresses was arrested and a luxury vehicle recovered; a second Nigerian case involving investment fraud run through messaging apps led to one arrest and traced about USD 2.4 million of cryptocurrency-laundered proceeds. Tanzania dismantled a malicious mobile loan app scheme, Gabon disrupted a social-media vehicle import fraud network, and the Republic of Congo arrested 30 cybercrime suspects. A separate Ghana/Nigeria action reportedly arrested 28 and identified over 100 human trafficking victims.

Private-sector partners reported across sources include Group-IB (intelligence on phishing kits, botnets, threat actors and fraudulent social media accounts, plus crypto investment scam and BEC infrastructure), Team Cymru, Kaspersky, Fortinet and Meta; the GLACY-e project (EU/Council of Europe) is also cited. Defender relevance: confirms continued high-volume BEC, phishing, investment-fraud and ransomware activity originating in or targeting Africa, and the value of infrastructure-level intelligence sharing for takedowns. Severity and status are analyst assignments, not source statements.

## MITRE ATT&CK

- T1566 Phishing
- T1589.001 Gather Victim Identity Information: Credentials
- T1583 Acquire Infrastructure
- T1585.001 Establish Accounts: Social Media Accounts
- T1684.001 Impersonation
- T1657 Financial Theft

## Sources

- [Cybercrime crackdown across Africa leads to 1,462 arrests, $105 million seized](https://therecord.media/africa-cybercrime-interpol-arrests)
- [Authorities disrupt nearly 11,000 cybercrime networks in Africa](https://www.bleepingcomputer.com/news/security/authorities-disrupt-nearly-11-000-cybercrime-networks-in-africa/)
- [Africa cybercrime crackdown nets 1,462 arrests and over $105 million](https://www.helpnetsecurity.com/2026/10/22/interpol-africa-cybercrime-crackdown-operation-serengeti-iii/)
- [Group-IB supports INTERPOL's Operation Serengeti III, leading to 1,462 arrests across Africa and over USD 105 million recovered](https://www.group-ib.com/media-center/press-releases/interpol-operation-serengeti-iii/)
- [Team Cymru Supports INTERPOL's Operation Serengeti III, Disrupting Cybercriminal Networks Across Africa](https://lifestyle.middletownlifemagazine.com/story/775716/team-cymru-supports-interpols-operation-serengeti-iii-disrupting-cybercriminal-networks-across-africa/)
- [INTERPOL cybercrime operation recovers $105M as Kenya joins 20 countries](https://www.pulse.co.ke/story/interpol-cybercrime-operation-recovers-dollar105-m-as-kenya-joins-20-countries-2026102210422293506)
- [Operation Serengeti 2.0: INTERPOL nabs 1,209 cybercriminals in Africa, seizes $97M](https://securityaffairs.com/181434/cyber-crime/operation-serengeti-2-0-interpol-nabs-1209-cybercriminals-in-africa-seizes-97m.html)
- [Operation Serengeti: INTERPOL arrested 1,006 suspects in 19 African countries](https://securityaffairs.com/171462/cyber-crime/operation-serengeti-interpol.html)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4148