Law enforcement agencies have announced the dismantling of approximately 11,000 cybercrime networks and the arrest of more than 1,400 individuals as part of the third edition of "Operation Serengeti III," which targeted Business Email Compromise (BEC), ransomware, and online fraud operations.
Operation Details and International Partners
The operation was executed under the coordination of the International Criminal Police Organization "Interpol," with the participation of authorities from 21 countries, alongside private sector partners in the field of cybersecurity such as "Team Cymru," "Kaspersky," "Group-IB," and "Fortinet." The campaign took place between June 29 and August 31, resulting in the recovery of illicit funds exceeding $105 million.
According to Interpol data, the investigation led to the identification of 65,929 victims, and total financial losses were estimated at more than $385 million. The operation saw specific interventions in several African countries; in Uganda, authorities dismantled two transnational fraud gangs and arrested 365 individuals linked to online investment and pension fraud operations. In Angola, authorities seized illegal cryptocurrency mining centers and arrested 9 suspects, while confiscating more than 2,000 mining devices. Additionally, in Nigeria, an individual suspected of managing a large-scale phishing and business email compromise operation that collected software credentials and approximately 2.1 million email addresses was arrested.
The Role of the Private Sector and Technical Cooperation
"Team Cymru" and other security companies provided support to the operation by providing investigators with intelligence and technical expertise, including essential information on suspicious domains, IP addresses, and Command and Control (C2) infrastructure, which helped in mapping criminal networks and identifying suspects.
Giacomo Picolini, Vice President of Global Data Partnerships at "Team Cymru," explained that the ability to monitor attacker infrastructure across the internet provides defenders with a completely different starting point, allowing for the exposure of the networks underlying criminal operations and enabling proactive defensive measures instead of waiting for an attack to occur.
Historical Context of Operations
This operation comes as a continuation of a series of previous security operations in the African continent:
- First Edition (Operation Serengeti): Executed between September and October 2024 in 19 countries, resulting in 1,006 arrests, the removal of 134,089 pieces of malicious infrastructure, and the recovery of approximately $44 million.
- Second Edition (Operation Serengeti 2.0): Executed between June and August 2025, resulting in 1,209 arrests, the dismantling of 11,432 pieces of malicious infrastructure, and the seizure of $97.4 million.