Authorities disrupt nearly 11,000 cybercrime networks in Africa

Operation Serengeti III was a coordinated law-enforcement campaign against cybercrime across Africa. It focused on business email compromise, ransomware, online scams, and related offenses. Its importance lies in attacking entire criminal operations rather than treating each incident as an isolated case.

To disrupt a cybercrime network, authorities identify and dismantle the infrastructure that supports it, arrest suspected participants, and recover illegal funds. The operation shut down 10,909 malicious networks. Investigators also used evidence about domains, IP addresses, and command-and-control systems to connect infrastructure with suspects.

The results show that disruption can reach beyond individual computers or accounts. Authorities identified 65,929 victims and estimated losses above $385 million, while recovering more than $105 million. Arrests and infrastructure takedowns may interrupt ongoing fraud, but the scale of the victims and losses shows why continued cooperation remains necessary.

Operation Serengeti III was large in both geography and results. Authorities from 21 countries coordinated the campaign with private cybersecurity partners. The operation ran from June 29 through August 31 and targeted several forms of cybercrime across Africa.

Investigators arrested 1,462 suspected cybercriminals and dismantled 10,909 malicious networks. They identified 65,929 victims and estimated financial losses at more than $385 million. Authorities also recovered more than $105 million in illegal funds, showing the financial scale of the criminal activity.

The figures describe both enforcement activity and human impact. The arrests and network takedowns measure the operation’s direct actions. The victim and loss figures show the damage linked to the investigated crimes. Together, they indicate a broad campaign involving organized operations rather than a small number of isolated offenders.

The operation addressed cybercrime that steals money, credentials, or access through digital systems. Its main targets included business email compromise, ransomware, online scams, phishing, and cryptocurrency investment fraud. These crimes differ in method, but all can produce financial losses and affect many victims.

Nigeria provides a clear example. Authorities arrested a person suspected of running a large phishing and business email compromise operation. Investigators said it harvested software credentials and collected approximately 2.1 million email addresses. In Uganda, police dismantled two transnational fraud rings linked to online investment and pension fraud.

The campaign also covered illegal cryptocurrency mining, malicious mobile lending applications, and fraudulent vehicle imports. In Angola, nine suspects were arrested and more than 2,000 mining devices were seized. This range shows that cybercrime enforcement must address many business models, not only malware or email attacks.

Interpol coordinated Operation Serengeti III, bringing together national law-enforcement agencies from 21 countries. National authorities carried out investigations, arrests, seizures, and network dismantling in their jurisdictions. This division allowed the operation to address criminal activity crossing borders.

Private partners strengthened that work with technical intelligence. Team Cymru, Kaspersky, Group-IB, and Fortinet provided information about suspicious domains, IP addresses, and command-and-control infrastructure. Those clues helped investigators map relationships among systems, operations, and suspects. National police could then act on the intelligence through arrests or seizures.

The partnership reflects how cybercrime investigations combine public authority with private-sector visibility. Team Cymru said its internet-scale view can expose attacker networks before defenders investigate damage. Operation Serengeti III therefore relied on both legal powers, such as arrests, and specialized technical capabilities for finding infrastructure.

Seizing funds, arresting suspects, and dismantling infrastructure attack different parts of a cybercrime operation. Financial seizures target the proceeds. Arrests target the people suspected of running or supporting the crimes. Infrastructure takedowns target the technical systems used to coordinate or deliver malicious activity.

Operation Serengeti III recovered more than $105 million and arrested 1,462 suspected cybercriminals. It also dismantled 10,909 malicious networks. In Angola, authorities seized more than 2,000 cryptocurrency-mining devices. These actions reduce access to money, people, equipment, and systems connected with the investigated operations.

The impact on victims is shown by the investigation’s broader figures. Authorities identified 65,929 victims and estimated financial losses above $385 million. Recovery of illegal funds does not erase those losses, but enforcement can interrupt criminal activity and provide investigators with evidence about how the operations worked.

Suspicious domains and IP addresses can reveal where a criminal operation hosts services, sends traffic, or connects compromised systems. Command-and-control, or C2, infrastructure is used to communicate with or coordinate malicious systems. Examining these technical markers helps investigators look beyond one device or message.

Private partners supplied information about these indicators during Operation Serengeti III. Investigators could compare domains, addresses, and C2 systems, then identify relationships among them. A cluster of shared infrastructure can help map a wider network and connect online activity with suspected operators.

This approach gives law enforcement a way to understand an operation’s structure before taking action. Team Cymru said its internet-scale visibility helps expose networks behind criminal operations. In this operation, that intelligence supported efforts to identify suspects and dismantle malicious networks rather than pursuing only individual incidents.

Stolen credentials are valuable because they can provide access through an existing account rather than requiring attackers to break in from scratch. Valid usernames and passwords may also make activity look more legitimate. Once inside an email account, criminals can read messages, imitate the account owner, and find contacts or business information.

That access can support fraud against many people or organizations. An attacker using one account may send convincing requests to contacts, redirect payments, or use harvested information to target additional accounts. The Nigerian case illustrates the scale: authorities suspected one operator of harvesting software credentials and amassing approximately 2.1 million email addresses.

The article also notes that once attackers have valid credentials, only 37% of their actions are blocked. That figure highlights the challenge after initial access. Protecting accounts and detecting misuse therefore matter alongside stopping the first unauthorized login.