INTERPOL-backed law enforcement operations across Africa have resulted in 1,462 arrests, the disruption of nearly 11,000 malicious networks and the recovery of more than $105mn in illicit funds, as authorities intensify efforts to dismantle transnational cybercrime organisations.
The crackdown, conducted between June 29 and August 31, 2026, involved law enforcement agencies from 21 countries and targeted online investment fraud, ransomware, business email compromise, digital extortion and other cyber-enabled financial crimes.
The operation, known as Serengeti III, identified 65,929 victims and linked criminal activities to financial losses exceeding $385mn, highlighting the scale of cybercrime affecting individuals, businesses and financial institutions across the continent.
US-based cybersecurity intelligence company Team Cymru, which participated as a private-sector partner, disclosed details of its involvement on Thursday, October 22, saying intelligence on the digital infrastructure used by criminal networks had helped investigators identify targets and disrupt operations.
The company said its contribution focused on analysing suspicious internet domains, IP addresses and command-and-control systems used by cybercriminals to coordinate attacks and conceal their activities.
Unlike conventional investigations that focus on individual incidents, infrastructure intelligence enables authorities to identify connections between criminal groups, track shared digital resources and target the systems supporting multiple illegal operations.
“Criminals cannot operate without infrastructure. They have to build it, connect it and maintain it, and those activities create opportunities to find them,” said Jacomo Piccolini, vice-president of global data partnerships at Team Cymru.
“Our ability to see attacker infrastructure at internet scale gives defenders a fundamentally different starting point. Instead of waiting for an attack and then investigating the damage, we can help expose the networks behind criminal operations and can enable defensive actions.”
Uganda, Angola and Nigeria among countries targeted
The operation produced significant enforcement actions in several African countries, exposing a range of financial fraud schemes and illegal digital operations.
In Uganda, authorities dismantled two transnational fraud networks and arrested 365 foreign nationals suspected of involvement in online investment and pension fraud schemes.
The arrests formed one of the largest country-specific enforcement actions disclosed during the operation, reflecting the international nature of criminal groups operating through digital platforms.
In Angola, investigators shut down two illegal cryptocurrency mining facilities, arrested nine suspects and seized more than 2,000 mining devices.
Nigerian authorities arrested a suspect allegedly connected to a large-scale phishing and business email compromise operation involving approximately 2.1mn email addresses.
Business email compromise typically involves criminals impersonating company executives, suppliers or business partners to manipulate financial transactions and redirect payments into fraudulent accounts.
Authorities also disrupted schemes involving malicious mobile lending applications, fraudulent vehicle imports and cryptocurrency-based investment scams.
The range of criminal activities uncovered during the operation illustrates how cybercrime networks increasingly combine conventional financial fraud with digital infrastructure to reach victims across national borders.
Cybersecurity companies support international investigations
The operation was coordinated by INTERPOL with technical and intelligence support from several private-sector organisations, including Team Cymru, Group-IB, Kaspersky, Fortinet, Uppsala Security, Cybercrime Atlas, Meta and the Global Anti-Scam Alliance.
Zimbabwe’s Postal and Telecommunications Regulatory Authority also supported the initiative.
Before enforcement operations began, participating investigators received intelligence on suspicious domains, IP addresses and other digital infrastructure associated with criminal activities.
The information helped authorities map connections between criminal operations, identify potential targets and prioritise investigations.
Team Cymru said analysing how criminal infrastructure is established, connected and reused could allow investigators to intervene before attacks occur, rather than responding only after financial losses have been reported.
“These results represent an extraordinary collective effort by INTERPOL and the participating law enforcement agencies,” Piccolini said.
“But they also reinforce something fundamental about cyber defense: you cannot disrupt what you cannot see.”
The company said the ability to identify relationships between digital systems was becoming increasingly important as criminal groups adapted their methods to evade detection and enforcement.
Artificial intelligence adds to Africa’s cybercrime challenge
The crackdown comes amid growing concern over the sophistication of cyber-enabled financial crime across Africa, where expanding digital payments, online banking and mobile financial services have increased the importance of cybersecurity.
INTERPOL’s African Cyber Threat Assessment Report 2026 highlighted the growing use of artificial intelligence by cybercriminals and the continued financial damage associated with online fraud and other digital offences.
Artificial intelligence can enable criminals to automate aspects of phishing campaigns, develop more convincing fraudulent communications and increase the scale of attempted attacks.
The international nature of cybercrime also complicates enforcement, as suspects, victims, financial accounts and technical infrastructure may be located in different jurisdictions.
Operation Serengeti III sought to address those challenges through coordinated investigations and intelligence sharing between national law enforcement agencies and private technology companies.
Team Cymru, which has operated since 2005, said its internet infrastructure intelligence supports more than 180 computer security incident response teams across over 140 countries.
The company also maintains more than 1,000 data-sharing partnerships worldwide.
Several investigations arising from Operation Serengeti III remain active, with authorities continuing to identify suspects, trace illicit financial proceeds and analyse digital evidence collected during the crackdown.
The operation’s results underline the increasing role of cross-border intelligence sharing and public-private partnerships in efforts to combat cybercrime across Africa, although the continued investigations mean the full extent of the criminal networks involved has yet to be established.
SUPPORT AFRICAN BUSINESS JOURNALISM
Help XOL Africa expand independent business reporting across Africa.
SUPPORT XOL AFRICA →
