Law enforcement agencies from 22 countries helped identify 263 suspects and arrested 58 individuals linked to cybercrime networks coordinated by African crime groups, officials said — a concentrated result of an international drive that ran from November 2025 through June 2026.
Operation Jackal IV: scope and primary targets
Operation Jackal IV, an international joint action focused on West African criminal networks, operated between November 2025 and June 2026. The operation targeted the Black Axe cybercrime syndicate — described in the reporting as “known for its involvement in global-scale cyber-enabled financial fraud” — and related networks that deploy romance scams, cryptocurrency and investment schemes, and business email compromise fraud. Authorities noted Black Axe and similar rings have often also been linked to violent crimes.
Arrests, seizures, and the geography of disruption
National law enforcement agencies reported a range of outcomes under the operation. Argentinian law officers made 17 arrests and linked 196 suspects to a major Crime-as-a-Service network that provided West African organized crime groups with web domains and money‑laundering support. South African authorities arrested 39 individuals, blocked 257 bank accounts, and seized $2.67 million from a criminal syndicate that targeted retirees in English‑speaking countries via investment and romance scams. Romanian police arrested 11 suspects tied to a call center operation that used promises of high returns in stocks or cryptocurrencies to lure victims into sophisticated investment scams. Italian authorities identified one suspect connected to a pan‑European money‑laundering network that moved funds through shell companies, remittance services, and cash withdrawals.
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleModus operandi: extortion, Crime‑as‑a‑Service, and the dark web
INTERPOL highlighted two recurring tactics observed during the actions. First, sexual extortion against minors: “Offenders typically contact minors via social media, build trust and coerce them into sharing explicit images or videos. They then threaten to distribute this material to the victim's contacts unless a ransom is paid,” INTERPOL said. Second, outsourcing of core criminal functions: “Some of these criminal syndicates were also observed procuring Crime‑as‑a‑Service from external providers, often through the dark web, to outsource key activities like money laundering and other critical operations.”
Complementary global operations: Red Card 2.0 and First Light 2026
Jackal IV was one element in a broader set of INTERPOL‑coordinated efforts. Between December 8 and January 30, African authorities arrested 651 suspects during Operation Red Card 2.0, which spanned 16 countries. In July, INTERPOL announced that investigators from 97 countries had arrested 5,811 suspects and seized $293 million in illicit assets during Operation First Light 2026. Those larger initiatives underscore parallel, multi‑national enforcement activity against fraud and related cybercrime.
What this means for technologists, policymakers, and affected citizens
- Technologists and security teams: the Blue Report 2026 warns that “overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply.” The report measures defenses technique by technique across 338 million simulations run in customer production environments — a reminder in the data that credential misuse and post‑access activity remain critical defensive gaps.
- Policymakers and law enforcement planners: the cross‑border arrests, bank‑account blocks, and asset seizures in multiple countries reflect both the transnational reach of West African‑linked syndicates and the use of Crime‑as‑a‑Service and the dark web to scale operations; those patterns will influence decisions about international cooperation, mutual legal assistance, and financial countermeasures.
- Affected citizens — retirees, investors, and minors: the operations reported arrests tied to scams that specifically targeted retirees in English‑speaking countries and described coercion of minors via social media. Those groups are named repeatedly in the operational findings as primary targets of the schemes disrupted.
The recent coordinated actions illustrate two realities at once: multinational criminal networks can be dismantled in part through concentrated international operations, and the same networks can reconstitute capabilities by buying services on the dark web and exploiting valid credentials once they gain access. The record provided by these operations — arrests, account blocks, and seized funds — is concrete; the challenge that remains is whether those gains will reduce the ability of these syndicates to rapidly re‑establish infrastructure and monetization paths.
