Operation Serengeti III: scope, timeline and partners
Operation Serengeti III was a coordinated, multinational law enforcement effort that ran from June 29 to August 31, 2026. INTERPOL reported that the action disrupted 10,909 malicious networks and involved law enforcement agencies from 21 countries across Africa and beyond. Participating nations included Angola, Benin, Cameroon, Congo, Côte d'Ivoire, Democratic Republic of Congo, Eswatini, Gabon, Gambia, Ghana, Kenya, Mozambique, Nigeria, Rwanda, Senegal, South Africa, Tanzania, Uganda, United States, Zambia, and Zimbabwe.
Arrests and tactical results
The operation resulted in the arrest of 1,462 suspects, INTERPOL said. Some of the largest single-country actions cited by the organization included the arrest of 365 foreign nationals in Uganda linked to transnational online investment and pension fraud schemes that targeted victims across Asia. Authorities also reported the arrest of 30 suspects linked to a cybercrime operation in the Republic of Congo.
In Angola, law enforcement dismantled two illegal cryptocurrency mining centers, arrested nine suspects and seized 2,000 cryptocurrency mining devices along with six illegal power transformation stations, assets INTERPOL says are valued at over $1 million. In Nigeria, two separate arrests were highlighted: one suspect in connection with a large-scale phishing and business email compromise operation that collected about 2.1 million email addresses, and another suspect accused of operating an international investment fraud scheme advertised via messaging apps; that second operation led to the movement of more than $2.4 million in suspected criminal proceeds, with a large portion of those funds laundered through cryptocurrency transactions.
The cyber insurance questionnaire just landed. Now what?
SOC 2, HIPAA, insurance renewals - someone has to own security strategy. Nubivance provides fractional CISO leadership without the full-time salary.
Get a security leadFinancial impact: victims, losses, and recoveries
INTERPOL’s public statement tied the operational disruptions to substantial criminal finance metrics. Authorities identified 65,929 victims and said financial investigations linked criminal activity to losses exceeding USD 385 million. Separately, participating forces recovered more than USD 105 million in illicit funds during the Serengeti III campaign.
Private-sector intelligence and operational enablers
Operation Serengeti III relied on private-sector intelligence alongside police action. Group-IB — named among many private partners — provided INTERPOL with threat intelligence data on phishing kits, botnets, and other malicious resources hosted in Africa or used to target the region. Jacomo Piccolini, vice president of Global Data Partnerships at Team Cymru, framed the contribution in operational terms: "Criminals cannot operate without infrastructure. They have to build it, connect it and maintain it, and those activities create opportunities to find them." Piccolini added that, "Instead of waiting for an attack and then investigating the damage, we can help expose the networks behind criminal operations and enable defensive actions. Operation Serengeti III demonstrates the real-world impact of putting that intelligence in the hands of law enforcement."
What this means for technologists, policymakers, and affected enterprises
- Technologists and security teams: the operation underlines the value of actionable intelligence on phishing kits, botnets and hosted malicious resources — the kinds of data Group-IB shared — to expose infrastructure and enable defensive actions, as Team Cymru described.
- Policymakers and international law-enforcement planners: INTERPOL’s director of cybercrime framed the outcome as validation of cross-border cooperation. Neal Jetton said, "Operation Serengeti III reinforces a clear message: while cybercrime is increasingly borderless, international cooperation remains one of the most effective tools for disrupting criminal networks, recovering criminal assets and protecting communities from digital harm."
- Affected enterprises and procurement leaders: the disruptions and the case examples — from credential-harvesting operations that amassed about 2.1 million email addresses to investment fraud schemes that moved more than $2.4 million via cryptocurrency — highlight the specific attack vectors and laundering channels organizations should monitor when assessing exposure and third‑party risk.
Conclusion
Operation Serengeti III presents a detailed snapshot: a concentrated, multinational surge of investigations and arrests, substantial recoveries, and the use of private‑sector intelligence to target the infrastructure of cybercrime. INTERPOL linked the campaign to more than 65,000 victims and financial losses exceeding USD 385 million while recovering over USD 105 million in illicit funds. The operation follows two earlier Serengeti waves in September–October 2024 and June–August 2025 that together led to more than 2,000 arrests, suggesting the campaign approach is an established tool for the agency. As INTERPOL and its partners tally disrupted networks and seized equipment, the question left by the record is operational and practical: will sustained, intelligence-driven, multinational action at this scale become a recurring cadence — and, if so, how will participating nations sustain the investigative and asset-recovery work these operations generate?
