Serengeti III arrest: 1,462 arrests and $105M recovered across 21 African nations

INTERPOL’s Serengeti III arrest operation, launched on June 29 and concluded on August 31, 2026, produced 1,462 arrests, disrupted 10,909 malicious networks, and recovered more than $105 million in illicit funds. The effort spanned 21 African nations and relied on intelligence from private security firms Group-IB and Team Cymru, according to a report on Hackread.com.

Scale of the crackdown

The operation identified 65,929 victims and linked criminal activity to financial losses exceeding $385 million. Law-enforcement teams in each participating country coordinated raids, seized assets, and collected forensic evidence that tied suspects to a web of phishing, fraud, and cryptocurrency-based schemes.

Private-sector intelligence in action

Group-IB supplied INTERPOL with data on phishing kits, botnets, and fraudsters operating in or targeting Africa. The firm also shared social-media footprints of suspected criminals, enabling investigators to trace recruitment and communication channels. Team Cymru contributed intelligence on suspicious domains, IP addresses, and command-and-control infrastructure, mapping the technical backbone of the networks.

Country-specific highlights

  • Uganda: Authorities dismantled two transnational fraud rings and arrested 365 foreign nationals involved in investment and pension scams aimed at Asian victims. Call centers using scripted communications and fake trading platforms were exposed.
  • Angola: Police seized more than 2,000 illegal mining devices and six power-transformation stations. The electrical infrastructure alone was valued at over $1 million, indicating a significant investment in illicit cryptocurrency mining.
  • Nigeria: A suspect linked to a phishing and business-email-compromise (BEC) operation was arrested. The investigation uncovered approximately 2.1 million compromised email addresses and more than $2.4 million in proceeds, much of which was laundered through cryptocurrency.
  • Tanzania, Gabon, Republic of Congo: Operations targeted a malicious mobile-lending application scheme, a vehicle import fraud network, and 30 suspects, respectively.

Implications for global cybercrime

The operation demonstrates that African cybercrime networks are increasingly sophisticated, leveraging both traditional fraud and infrastructure-based revenue streams. The seizure of mining hardware in Angola points to a shift toward monetizing computational resources, while the Nigerian BEC case highlights the continued threat of credential harvesting and cryptocurrency laundering.

What readers should verify

  • If you operate a business in any of the 21 countries, confirm that your email and financial systems are protected against phishing and BEC attacks.
  • Verify the legitimacy of any mining or cryptocurrency-related operations in your jurisdiction; seized hardware in Angola suggests a growing illicit market.
  • Monitor domain registrations and IP addresses linked to known malicious infrastructure, as Team Cymru’s intelligence indicates that many command-and-control servers remain active.

Next steps for law enforcement and the private sector

The success of Serengeti III may encourage other regions to adopt similar hybrid models, combining international law-enforcement coordination with private-sector threat intelligence. Continued collaboration will be essential to keep pace with the evolving tactics of cybercriminals.

Open question

How will the seizure of large-scale mining equipment in Angola affect the global cryptocurrency mining landscape, and what regulatory responses might follow in other jurisdictions?

Explore more on this topic