An international operation coordinated by the International Criminal Police Organization (INTERPOL) has led to 1,462 arrests, the disruption of 10,909 malicious cyber networks and the recovery of more than $105 million in suspected illicit funds across Africa and the United States.
The crackdown, known as Operation Serengeti III, ran from 29-06-2026 to 31-08-2026 and involved law enforcement agencies from 20 African countries and the US. It targeted cyber-enabled crimes, including online investment fraud, ransomware, phishing, business email compromise, digital extortion and other internet-based scams.
In an announcement published on 22-10-2026, INTERPOL said investigators identified 65,929 victims linked to the cases and traced the criminal activities under investigation to financial losses exceeding $385 million.
The operation brought together authorities from Angola, Benin, Cameroon, the Republic of Congo, Côte d’Ivoire, the Democratic Republic of Congo, Eswatini, Gabon, The Gambia, Ghana, Kenya, Mozambique, Nigeria, Rwanda, Senegal, South Africa, Tanzania, Uganda, Zambia and Zimbabwe, alongside the United States.
The results highlight the scale of cybercrime across borders and the role of international cooperation in identifying suspects, disrupting criminal infrastructure and tracing money linked to alleged offences.
How the operation targeted cybercrime networks
Investigators focused on criminal schemes that exploit internet services, digital communications and financial technology to defraud individuals, businesses and institutions.
Before the operation began, participating countries received intelligence on suspicious internet domains, Internet Protocol addresses and command-and-control systems associated with suspected cybercriminal activity.
Command-and-control systems allow criminals to communicate with and direct compromised computers and other devices. Disrupting this infrastructure can help investigators expose connected networks and prevent further attacks.
Private-sector cybersecurity organizations also supported the operation by providing threat intelligence, technical analysis and investigative assistance. Their input helped authorities identify targets and establish links between suspected criminal activities in different countries.
INTERPOL Director of Cybercrime Neal Jetton said the operation demonstrated the importance of international partnerships in confronting criminal networks that exploit technology and operate across national boundaries.
The coordinated approach was designed to help law enforcement agencies share intelligence, investigate offences and trace suspected criminal proceeds that might otherwise be difficult to pursue within a single jurisdiction.
Uganda arrests 365 foreign nationals over alleged investment fraud
Uganda recorded one of the operation’s largest arrest figures after authorities dismantled two alleged transnational fraud networks and arrested 365 foreign nationals suspected of involvement in online investment and pension scams.
Investigators uncovered call-centre operations that allegedly used prepared scripts, fraudulent websites and fake trading platforms to persuade victims, including pensioners in Asian countries, to invest in non-existent financial opportunities.
The schemes reportedly relied on convincing online platforms and coordinated communications to make the supposed investments appear legitimate.
The case illustrates how online fraud does not always depend on sophisticated hacking. Criminal groups can also exploit websites, messaging services and organized telephone operations to persuade victims to transfer money voluntarily.
The suspects’ alleged involvement remains subject to the relevant legal processes.
Angola shuts down illegal cryptocurrency mining centres
In Angola, authorities dismantled two illegal cryptocurrency mining facilities, arrested nine suspects and seized more than 2,000 mining devices.
Investigators also confiscated six electricity transformation stations linked to the facilities. INTERPOL put the value of the seized electrical infrastructure at more than $1 million.
Cryptocurrency mining uses computing equipment to perform calculations required by certain blockchain networks. While mining can be a legitimate business, operations may breach the law when they violate electricity, licensing or other regulatory requirements.
The Angolan investigation extended the crackdown beyond online scams to the physical infrastructure associated with suspected digital offences.
Nigerian investigations uncover phishing and investment fraud
Nigeria participated in investigations targeting phishing, business email compromise and alleged investment fraud.
In one case, authorities arrested a suspect linked to a large-scale phishing and business email compromise operation. Investigators reportedly discovered that the operation had collected about 2.1 million email addresses and obtained software credentials.
Phishing involves deceptive messages designed to trick people into revealing sensitive information, such as passwords and login details. Business email compromise occurs when criminals impersonate trusted contacts or gain access to business email accounts to manipulate payments or obtain confidential information.
Such schemes can be particularly damaging because victims may believe they are dealing with legitimate colleagues, suppliers or business partners.
Authorities also recovered a luxury vehicle suspected of having been purchased with proceeds from criminal activity.
In a separate investigation, Nigerian authorities targeted an alleged international investment fraud scheme promoted through messaging applications. The case led to an arrest and uncovered the movement of more than $2.4 million in suspected criminal proceeds, much of which was reportedly channelled through cryptocurrency transactions.
Investigators may need to reconstruct multiple digital transactions to determine where suspected criminal funds originated, how they were transferred and who ultimately controlled them.
However, the identification of suspicious transactions or the recovery of suspected criminal assets does not automatically establish a suspect’s guilt or guarantee that victims will be compensated. Those outcomes depend on the evidence and subsequent legal and asset-recovery processes.
Tanzania, Gabon and Congo report further arrests
Other countries also recorded enforcement actions against different forms of suspected cyber-enabled crime.
Authorities in Tanzania dismantled a scheme involving malicious mobile loan applications, while investigators in Gabon disrupted a vehicle import fraud network that allegedly operated through social media.
In the Republic of Congo, 30 suspects were arrested in connection with a cybercrime operation.
The cases demonstrate the range of offences targeted during Operation Serengeti III, from fraudulent financial schemes and deceptive online advertising to the misuse of digital platforms and infrastructure.
Recovered funds fall short of total losses
INTERPOL’s figures show that authorities recovered more than $105 million in suspected illicit funds, while the financial losses linked to the investigated criminal activities exceeded $385 million.
The figures measure different things. The recovered amount represents funds authorities reported retrieving, while the losses reflect the broader financial damage associated with the cases under investigation. The recovery figure should not be interpreted as the total compensation paid to victims.
Asset recovery can help investigators trace financial networks, connect suspects to alleged offences and identify further criminal activity. However, the extent to which recovered funds can be returned to victims depends on legal proceedings and the processes governing seized assets.
The 65,929 victims identified during the operation also illustrate the wider consequences of cybercrime. Beyond financial losses, victims may suffer compromised personal information, disrupted business operations and difficulties regaining access to affected accounts or systems.
INTERPOL’s findings indicate that the full impact may become clearer as investigations continue and authorities identify additional victims, transactions and suspected links between criminal networks.
