Interpol operation dismantles nearly 11,000 cybercrime networks in Africa

According to BleepingComputer, law enforcement across 21 countries has dismantled nearly 11,000 cybercriminal networks and arrested more than 1,400 people in an operation coordinated by Interpol. The action, called Operation Serengeti III, ran between June 29 and August 31 and targeted business email compromise, ransomware, and online scams across Africa.

The numbers are specific. Authorities arrested 1,462 suspected cybercriminals and dismantled 10,909 malicious networks. The investigation identified 65,929 victims, with estimated financial losses of more than $385 million. Investigators recovered more than $105 million in illegal funds during the operation.

What was taken down

In Uganda, police broke up two transnational fraud rings and arrested 365 individuals linked to online investment and pension fraud. In Angola, nine suspects were arrested at illegal cryptocurrency mining centers, and more than 2,000 mining devices were seized. In Nigeria, one individual was arrested over a phishing and business email compromise operation that harvested software credentials and amassed approximately 2.1 million email addresses. Interpol says the operation also hit malicious mobile lending apps, fraudulent vehicle imports, and cryptocurrency investment scams.

Who made it possible

Private firms did the groundwork that gave investigators somewhere to start. Team Cymru, Kaspersky, Group-IB, and Fortinet supplied intelligence on suspicious domains, IP addresses, and command-and-control infrastructure, which let investigators map networks before making arrests. Jacomo Piccolini of Team Cymru described the shift this way: visibility into attacker infrastructure means defenders no longer wait for an attack and then investigate the damage; they can expose the network first.

That sequence is the part worth noticing. The operation did not start from victim reports. It started from infrastructure, the domains and servers criminals had to use to run the scams, and worked backward to the people and the money. That is a different model from waiting for a complaint to arrive.

This is also not a one-off. Operation Serengeti III follows two earlier rounds. The first, run across 19 African countries in late 2024, produced 1,006 arrests and recovered roughly $44 million. A second round in mid-2025 produced 1,209 arrests and seized $97.4 million. Each round has grown in scale, and each has relied on the same combination: government agencies working alongside private cybersecurity firms that can see the infrastructure before a victim ever reports a loss.

For the 65,929 identified victims, the recovered funds matter directly. For everyone else, the pattern matters because it shows cybercrime infrastructure can be mapped and disrupted at scale, across borders, before the damage is fully done.