Threat IntelligenceEmerging Threats

Interpol Disrupts 11,000 African Cybercrime Networks

Analyst 207||Source: BleepingComputer
Law enforcement officers from various countries gather around a table with laptops and notes in a briefing room with a…

"Our ability to see attacker infrastructure at internet scale gives defenders a fundamentally different starting point." — Jacomo Piccolini, Team Cymru's VP of Global Data Partnerships.

Interpol-led Operation Serengeti III: scope, timing, and partners

Operation Serengeti III, coordinated by Interpol, ran between June 29 and August 31 and involved law enforcement authorities from 21 countries working with private partners including Team Cymru, Kaspersky, Group-IB, and Fortinet. According to Interpol's press release, the operation targeted business email compromise, ransomware, and online scams across Africa and focused investigative and technical resources on dismantling criminal infrastructure rather than only responding to individual incidents.

Arrests and network takedowns: the headline figures

Interpol reports that the operation resulted in the arrest of 1,462 suspected cybercriminals and the dismantling of 10,909 malicious networks. Investigators identified 65,929 victims and estimated financial losses at more than $385 million, while recovering more than $105 million in illegal funds. The scope of the action reflects a multi-month, cross-border enforcement push following two earlier phases named Operation Serengeti (September–October 2024) and Operation Serengeti 2.0 (June–August 2025).

Regional results: Uganda, Angola, Nigeria and specific operations

Several concrete law-enforcement outcomes were highlighted by Interpol. In Uganda, authorities dismantled two transnational fraud rings and arrested 365 individuals suspected of links to online investment and pension fraud operations. In Angola, investigators arrested nine suspects at illegal cryptocurrency mining centers and seized more than 2,000 mining devices. In Nigeria, one individual was arrested who is suspected of operating "a large-scale phishing and business email compromise operation that harvested software credentials and amassed approximately 2.1 million email addresses." Interpol also noted impacts on malicious mobile lending applications, fraudulent vehicle imports, and cryptocurrency investment scams.

Private-sector intelligence: domains, IPs, and command-and-control mapping

Private cybersecurity firms provided critical technical intelligence. Team Cymru and other firms supplied information on suspicious domains, IP addresses, and command-and-control (C2) infrastructure, which Interpol says helped investigators map criminal networks and identify suspects. As Piccolini put it in the press release, that visibility allows defenders to "expose the networks behind criminal operations" and enable defensive actions before or alongside takedown activity.

What this means for technologists, law enforcement, and affected businesses

  • Technologists and security teams: The operation underlines the value of internet-scale telemetry and externally sourced indicators — domains, IPs, and C2 signatures — to trace and disrupt campaign infrastructure. The source material also cites the Blue Report 2026 finding that "overall prevention scores can hide what happens after initial access" and that "once attackers are using valid credentials, prevention drops sharply," reinforcing the importance of detection and credential-protection controls.
  • Law enforcement and investigators: The arrests and device seizures in Uganda, Angola, and Nigeria show a mix of criminal activity—from investment fraud to illicit crypto mining—responding to combined investigative and technical inputs. Interpol's coordination across 21 countries demonstrates a model of public–private cooperation for mapping and dismantling transnational networks.
  • Affected enterprises and victims: With 65,929 identified victims and estimated losses above $385 million, the operation illustrates both the scale of harm and the limits of recovery: Interpol reports more than $105 million recovered, leaving a substantial gap between losses estimated and funds retrieved.

Operation Serengeti III builds on two prior phases: the first Operation Serengeti (September–October 2024) that produced 1,006 arrests, the takedown of 134,089 malicious infrastructures and networks, and roughly $44 million recovered; and Serengeti 2.0 (June–August 2025) with 1,209 arrests, the dismantling of 11,432 malicious infrastructures, and $97.4 million seized. Together, these operations show a repeated emphasis on disrupting infrastructure and recovering illicit proceeds as part of regional enforcement strategies.

The operation's numbers are large and specific: 10,909 networks dismantled in Serengeti III, 1,462 arrests, and more than $105 million recovered during the June–August window. The concrete seizures — over 2,000 mining devices in Angola and the arrest linked to 2.1 million harvested email addresses in Nigeria — provide tangible evidence of the varied criminal business models authorities pursued. Whether this pattern of coordinated takedowns and recoveries produces sustained reductions in victimization will be a question for the months ahead.

https://www.bleepingcomputer.com/news/security/authorities-disrupt-nearly-11-000-cybercrime-networks-in-africa/

Business Email CompromiseEmerging ThreatsInterpolLaw EnforcementRansomwareCybercrime NetworksOnline ScamsAfrican CybercrimeOperation Serengeti IIITeam Cymru
Related Intelligence

Continue Reading

Server room with rows of racks and cables, one with a highlighted vulnerable system.

Threat Actors Exploit PHP2Shell Vulnerabilities Before Public Disclosure

Threat actors made a move to exploit PHP2Shell vulnerabilities just four days before they were publicly disclosed, with a suspicious probe detected by Amazon's Threat Intelligence team on October 17, 2026, originating from an anonymized IP address in Australia. This early attempt suggests that malicious actors had somehow gotten wind of the vulnerability before its scheduled reveal.

Analyst 207
Software development workstation with laptop, notes, and equipment on a neutral background.

LiteLLM Exposes GitHub Token Leak Behind Malicious Package Release

A recent investigation revealed that a GitHub token leak was behind a malicious package release, specifically when Claude Code embedded a user's GitHub CLI OAuth token into a response body, potentially exposing it in LiteLLM logs. This led to a compromised release pipeline and a poisoned package, LiteLLM v1.107.0, being pushed to multiple registries on October 21, 2026.

Analyst 207
Industrial control system sits on a table amidst stacked crates in a brightly-lit warehouse or shipping yard.

Microsoft Warns of China-Linked Hackers Using AI in Supply Chain Attacks

Microsoft warns that China-linked hackers are leveraging AI to supercharge supply chain attacks, allowing them to swiftly exploit compromised apps and gain access to target environments. This alarming tactic was recently used to breach the ConnectWise Cloud Backup application.

Analyst 207
Cluttered server room with cables, equipment, and a laptop showing a blurred interface.

Threat Actor Wields AI in Multiform Cybercrime Spree

Meet BUGSTER, a cunning threat actor who's taking cybercrime to the next level with AI - and getting away with it all from a single US server. This tech-savvy crook is using AI-powered tools to pull off a wide range of crimes, from credential theft and data exfiltration to VoIP fraud and cryptocurrency reconnaissance.

Analyst 207