Serengeti III Disrupts BEC and Ransomware Networks Across Africa
INTERPOL-coordinated raids arrested 1,462 suspects and seized over $105 million in illicit funds across 21 nations during the summer of 2026.
Key points
- Police in 21 countries arrested 1,462 suspects and dismantled 10,909 malicious networks during Operation Serengeti III.
- Investigators recovered more than $105 million in illicit funds tied to losses exceeding $385 million from 65,929 victims.
- The operation targeted business email compromise, ransomware, fraud and digital extortion across African nations and the US.
INTERPOL coordinated Operation Serengeti III, a cybercrime sweep involving 21 nations that ran from June 29 to August 31, 2026. Authorities arrested 1,462 suspects and took down 10,909 malicious networks linked to significant financial losses.
What happened
Police in 21 countries, including 20 African nations and the United States, participated in the operation according to Help Net Security. Investigators recovered more than $105 million in illicit funds and identified 65,929 victims. The criminal networks were linked to losses exceeding $385 million through fraud, ransomware and business email compromise.
INTERPOL provided intelligence on suspicious domains, IP addresses and command-and-control infrastructure before the operation began, according to The Record. Private firms including Group-IB, Kaspersky, Fortinet, Team Cymru and Meta helped identify targets and map the networks. This intelligence allowed authorities to locate servers used to send instructions to compromised machines.
In Uganda, authorities broke up two transnational fraud rings and arrested 365 foreign nationals, according to Help Net Security. These groups operated rotating call centres with scripted pitches and fake trading platforms to deceive pensioners in Asia. Victims were steered into non-existent investments through fraudulent websites.
Angolan investigators shut two illegal cryptocurrency mining centres and arrested nine suspects, seizing more than 2,000 mining devices, according to The Record. Police also confiscated six illegal power transformation stations valued at more than $1 million. This followed previous raids on mining centres operated by foreign nationals in earlier operations.
Nigerian authorities arrested a suspect behind a phishing and business email compromise operation that harvested software credentials, according to Help Net Security. The suspect collected roughly 2.1 million email addresses and investigators recovered a luxury car believed to be bought with proceeds. A second case involved investment fraud pushed through messaging apps.
Why it matters
The scale of the operation highlights the transnational nature of modern cybercrime, with victims and perpetrators spanning multiple continents. The involvement of private sector partners in mapping networks demonstrates the increasing reliance on commercial intelligence for law enforcement. The recovery of millions in funds suggests that financial trails remain a viable vector for disruption.
Next steps
- Monitor official channels for updates on seized infrastructure and known malicious indicators.
- Review current email filtering rules to block credentials harvesting attempts.
- Verify the legitimacy of investment platforms and trading services used by staff.
- Ensure power and network monitoring detects unusual resource consumption patterns.
Detection notes
Teams usually notice business email compromise through unexpected payment requests or changes in vendor account details. Check whether email headers show spoofed domains or unusual routing paths. Look for credentials harvesting attempts in login failure logs or unexpected password reset requests. Containment moves include isolating compromised accounts and verifying transactions through secondary channels.
What to do and how to stay safe: INTERPOL
- Implement multi-factor authentication for all email and financial systems to prevent credential misuse.
- Establish out-of-band verification procedures for any request involving fund transfers or sensitive data.
- Monitor network traffic for connections to known command-and-control infrastructure or suspicious domains.
- Educate staff on recognising social engineering tactics used in phishing and investment fraud schemes.
Step-by-step guide: How to Prevent Account Takeover: The Technical Controls That Actually Work
General security guidance from the Packet Tribune newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
How many arrests were made during Operation Serengeti III?
Police in 21 countries arrested 1,462 suspects during the operation.
What types of cybercrime were targeted in the operation?
The operation targeted fraud, ransomware, business email compromise, online scams and digital extortion.
Which private firms assisted in the operation?
Group-IB, Kaspersky, Fortinet, Team Cymru and Meta helped identify targets and map the networks.
