INTERPOL coordinates Operation Serengeti III, arrests 1,462 across 21 nations

Joint law enforcement action recovers $105 million and disrupts over 10,900 networks linked to fraud and ransomware.

Threat Times Intrusion DeskOctober 22, 20262 min read

Illustration: A large wooden table covered with blank white maps and tangled red strings connects various pins. — AI-generated illustration: Threat Times

Key points

INTERPOL and 21 countries arrested 1,462 suspects and seized $105 million in illicit funds.
Investigators identified 65,929 victims and linked the networks to losses exceeding $385 million.
Private firms provided intelligence on command-and-control infrastructure and suspicious domains.

INTERPOL coordinated Operation Serengeti III, a cybercrime sweep that ran from June 29 to August 31, 2026, resulting in 1,462 arrests across 21 countries. The operation targeted malicious networks involved in fraud, ransomware, and business email compromise, with participants including twenty African nations and the United States.

Investigators recovered more than $105 million in illicit funds and dismantled 10,909 malicious networks during the campaign. Financial analysis tied these operations to losses exceeding $385 million. Authorities identified 65,929 victims who suffered from various digital crimes, including online scams, digital extortion, and investment fraud.

Intelligence and private sector support

Before the operation launched, INTERPOL provided investigators with intelligence on suspicious domains, IP addresses, and command-and-control infrastructure. Private security firms, including Group-IB, Kaspersky, Fortinet, Team Cymru, and Meta, helped identify targets and map the criminal networks. This collaboration allowed law enforcement to pinpoint the servers used to send instructions to compromised machines.

The operation built on previous efforts in 2024 and 2025, which also targeted gangs responsible for millions in global losses. By combining international police resources with private sector threat intelligence, authorities were able to disrupt large-scale criminal ecosystems that had previously operated with relative impunity across multiple jurisdictions.

Country-specific enforcement actions

In Uganda, authorities arrested 365 foreign nationals and broke up two transnational fraud rings. These groups operated rotating call centers with scripted pitches, fake trading platforms, and fraudulent websites. They targeted pensioners in Asia, persuading them to invest in non-existent schemes. Local media reported that many of the arrested individuals were from South and East Asia.

Angolan investigators shut down two illegal cryptocurrency mining centers, arresting nine suspects and seizing more than 2,000 mining devices. Police also confiscated six illegal power transformation stations, valued at over $1 million. This action followed raids in 2025 on 25 mining centers allegedly operated by Chinese nationals during Operation Serengeti II.

Nigerian authorities arrested a suspect running a phishing and business email compromise operation. The suspect harvested software credentials and collected roughly 2.1 million email addresses. Investigators recovered a luxury car believed to be purchased with the proceeds. A second Nigerian case involving investment fraud via messaging apps led to one arrest and traced over $2.4 million in suspected proceeds.

Authorities in Tanzania dismantled a malicious mobile loan app scheme. In Gabon, they disrupted a vehicle import fraud network operating on social media. In the Republic of Congo, police arrested 30 suspects tied to a cybercrime operation. These actions highlight the diverse nature of the threats addressed by the joint campaign.

What should you do?

Organizations should verify the legitimacy of all incoming communications, especially those requesting financial transfers or sensitive data. Users should monitor their financial accounts for unauthorized transactions and report suspicious activity immediately. Businesses should implement strict verification procedures for business email compromise requests. Individuals should avoid clicking on links from unknown sources and ensure their software is up to date.

Background: Threat intelligence program

A cyber intelligence program collects, analyzes, and distributes data about threats to help you defend your organization. It works by connecting external threat feeds to internal telemetry. You affect your security posture by prioritizing context over volume, ensuring every alert ties to a specific business risk or asset.

Read the full guide: Build a Cyber Intelligence Program That Cuts Noise and Finds Threats

What to do and how to stay safe: INTERPOL

Verify the authenticity of any request for funds or sensitive information through a secondary channel.
Monitor bank and credit card statements regularly for unauthorized transactions or unfamiliar charges.
Use strong, unique passwords and enable multi-factor authentication on all critical accounts.
Keep software and operating systems updated to protect against known vulnerabilities.

Step-by-step guide: Social Engineering Warning Signs and How to Respond

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.