Third Serengeti Sweep Tops 1,400 Arrests as Investigations Mature
Interpol’s annual Operation Serengeti, now on its third iteration, led to 1,462 arrests across 20 African countries and the US, recovering $105 million in stolen funds.
Interpol’s annual Operation Serengeti, now on its third iteration, led to 1,462 arrests across 20 African countries and the US, recovering $105 million in stolen funds.
A two-month operation in Africa led to the arrests of nearly 1,500 cybercrime suspects across 20 African countries and the US, the recovery of $105 million in stolen funds, and the shutdown nearly 11,000 malicious networks.
The third annual roundup of cybercriminals and financial scammers, dubbed Operation Serengeti III, aimed to take down groups responsible for ransomware, phishing, and cyber-enabled fraud, Interpol stated. The operation expanded the impact of cyber-focused investigations from previous law enforcement efforts in 2024 and 2025, which netted 1,006 suspects in the original Operation Serengeti and 1,209 suspects in last year’s effort, dubbed Operation Serengeti 2.0.
The increasing arrests shows that the national law enforcement partners are becoming more mature in their investigative practices and collaboration across jurisdictions, says Neal Jetton, director for cybercrime at Interpol.
“Rising arrest figures reflect stronger enforcement activity, not a change in the scale of offending,” he says. “The success of law enforcement efforts should be judged by whether fewer people are victimized over time and not by the number of suspects arrested or victims identified during a specific operation.”
The crackdown came as cybercriminals in the region continue to develop more sophistication in their operations, with a survey of African members finding that 72% of the 36 African countries have discovered a criminally operated scam center and more than half of cybercrime cases involved the use of AI — 8% frequently and 47% occasionally, according to Interpol’s “African Cyberthreat Assessment Report 2026.”
The data highlights the rapid improvements in cybercriminal infrastructure, says Jacomo Piccolini, vice president of global data partnerships at Team Cymru.
“Scams that once looked like individual schemes now run like businesses, with recruitment pipelines, international staff, and, increasingly, trafficked workers,” he says.
Busting Transnational Criminal Orgs
In Uganda, for example, two transnational criminal organizations (TCOs) used a rotating call-center model with scripted communications, fraudulent websites, and fake trading platforms to convince elderly victims in Asia to invest in their financial scams, Interpol said in a statement on Operation Serengeti III’s impact. Ugandan law enforcement authorities successfully dismantled the fraud rings, arresting 365 foreign nationals, consisting almost entirely of citizens from various Asian nations, Interpol’s Jetton says.
In another arm of the operation, national police arrested nine suspects in Angola, dismantling two illegal cryptocurrency mining sites and seizing more than 2,000 devices used to mine crypto along with six illegal power transformers valued at more than US $1 million. Cybercriminal mining operations are a common way to generate cryptocurrency, the favored method of cashing out on illegal schemes, Jetton says.
“Cryptocurrency played a significant role in moving the proceeds,” Jetton says. “It is now the principal rail for this type of fraud.”
In Nigeria, police shuttered two fraud operations: One using 2.1 million email addresses to create a large-scale phishing and business email compromise (BEC) operation, while another scheme focused on international investment fraud and garnered at least US $2.4 million in profits, Interpol stated.
The schemes showed off the role that AI is taking in enabling cybercriminal campaigns. The phishing and BEC campaigns used email addresses and AI agents to scrape information from LinkedIn and other social media to identify high-value targets, Jetton says.
“AI enabled the threat actor to create highly personalized phishing emails by mimicking the writing style of executives, colleagues, and suppliers,” he says, adding that “AI helped criminals manage and prioritize millions of email addresses for large-scale campaigns and, in some cases, combined with voice cloning, deepfake videos, and AI chatbots to make social engineering attacks even more convincing.”
Maturing Collaboration Between Law Enforcement
Law enforcement collaboration is making the individual nations more effective in tackling transnational cybercrime. With international partners, the individual countries are able to gain intelligence on signs of cybercriminal activities in their country, says Team Cymru’s Piccolini.
“The biggest change is timing. Since Serengeti 2.0, investigators have gone in with intelligence on suspicious IP addresses, domains, and command-and-control servers before the operation begins, along with training in open source, crypto, and ransomware investigation.”
Without such collaboration, TCOs could evade repercussions, especially if they limited their activities to impacting only citizens of other nations, as in the case of the Asian investment fraud ring.
“Actors targeting victims in Europe and North America use infrastructure spread across multiple jurisdictions, which makes it harder to pursue through any single country,” Piccolini says. “That’s a big part of why international operations like Serengeti, with partners who can see across borders, matter so much.”
Both Interpol and Team Cyrmu stressed that several operations are ongoing with investigators continuing to use seized data and other information to pursue suspected cybercriminals.
Read more about:
