INTERPOL Arrests 1,462 Suspects, Disrupts 10,909 Cybercrime Networks in Global Crackdown

Operation Serengeti III was a coordinated law enforcement operation against cybercrime networks. It ran from June 29 to August 31, 2026, with agencies from 21 countries working together. The operation targeted both criminal activity and the infrastructure supporting it. That matters because cybercrime networks can reach victims across borders and operate at large scale.

Authorities disrupted 10,909 malicious networks and identified 65,929 victims. Investigations connected the activity to losses exceeding $385 million, while more than $105 million in illicit funds was recovered. Police also arrested 1,462 suspects. The cases included online investment fraud, pension fraud, phishing, business email compromise, cryptocurrency laundering, and illegal mining.

The operation shows why international coordination matters. Criminal networks may use infrastructure in one country, target victims in another, and move money through a third. By sharing intelligence and acting together, authorities can dismantle networks, seize equipment, recover assets, and protect communities from further digital harm.

Operation Serengeti III involved a striking number of people, networks, and victims. Law enforcement agencies arrested 1,462 suspects and disrupted 10,909 malicious networks during the operation. Authorities identified 65,929 people who had been targeted by cybercriminal networks. These figures show that the crackdown reached far beyond isolated online scams.

The financial impact was also substantial. Investigations linked the criminal activity to losses exceeding $385 million. Authorities recovered more than $105 million in illicit funds. Those totals reflect the money connected to the cases, while the victim figure shows the wide human reach of the networks.

The scale also explains why coordinated action was necessary. Cybercrime networks can run many schemes at once and target people in different countries. Operation Serengeti III combined arrests, network disruption, financial investigations, and asset recovery. Together, those actions weakened criminal operations while giving authorities a clearer view of their victims and proceeds.

The participating countries were Angola, Benin, Cameroon, Congo, Côte d'Ivoire, Democratic Republic of Congo, Eswatini, Gabon, Gambia, Ghana, Kenya, Mozambique, Nigeria, Rwanda, Senegal, South Africa, Tanzania, Uganda, the United States, Zambia, and Zimbabwe. Agencies from all 21 countries joined Operation Serengeti III.

Cross-border cooperation was essential because the networks did not operate within one jurisdiction. Uganda, for example, arrested 365 foreign nationals linked to fraud schemes targeting victims across Asia. Nigeria investigated operations involving international investment fraud, phishing, and business email compromise. The operation also involved intelligence about infrastructure hosted in Africa or used to attack the region.

INTERPOL’s cybercrime director said criminal networks operate without regard for borders. Joint action lets police share intelligence, connect cases, arrest suspects, disrupt infrastructure, recover assets, and protect victims across jurisdictions. Operation Serengeti III followed two earlier waves and demonstrated that international cooperation remains a powerful response to borderless cybercrime.

Operation Serengeti III disrupted several forms of cybercrime rather than one single scheme. Authorities addressed online investment and pension fraud, phishing, business email compromise, illegal cryptocurrency mining, and cryptocurrency-based money laundering. These crimes can steal credentials, deceive victims, consume illegal power, or move criminal proceeds.

Uganda dismantled two fraud rings and arrested 365 foreign nationals linked to investment and pension schemes targeting Asia. Angola shut down two illegal cryptocurrency mining centers, arrested nine suspects, and seized 2,000 mining devices. In Nigeria, one suspect was connected to phishing and business email compromise involving software credentials and about 2.1 million email addresses. Another suspect allegedly ran investment fraud and moved more than $2.4 million.

The cases show how varied cybercrime operations can be. Some attack people directly through deception. Others exploit computing equipment, email accounts, or financial channels. Authorities therefore used arrests, infrastructure seizures, intelligence sharing, and financial investigations together.

When authorities seize infrastructure and recover illicit funds, criminal networks lose resources needed to operate. Disrupting servers, devices, accounts, or other malicious systems can interrupt attacks and expose connections between suspects. Recovering money also removes criminal proceeds that could support further fraud, laundering, or infrastructure.

The operation illustrates this effect. Angola seized 2,000 cryptocurrency mining devices and six illegal power transformation stations valued at over $1 million. Investigators also recovered more than $105 million in illicit funds across the wider operation. These actions reduced the networks’ operating capacity and gave law enforcement evidence for financial investigations.

Victims and businesses may benefit when attacks stop or become harder to repeat. However, the article does not state that victims received compensation or that every loss was recovered. It does show a broader consequence: coordinated seizures and asset recovery can protect communities, expose criminal links, and make cybercrime networks more difficult to sustain.

Private companies help police by observing digital threats and sharing information about the infrastructure behind them. Group-IB provided INTERPOL with intelligence on phishing kits, botnets, and other malicious resources hosted in Africa or used against the region. This information can help investigators connect tools, systems, and attacks.

Team Cymru described the mechanism clearly: criminals must build, connect, and maintain infrastructure. Those activities create opportunities to find them. Instead of waiting for an attack and investigating the damage, threat intelligence can expose the networks supporting criminal operations. Police can then use that information to take defensive or enforcement action.

Operation Serengeti III shows the practical value of public-private cooperation. Private partners contributed data, while law enforcement agencies used intelligence in a coordinated operation across 21 countries. The article identifies Group-IB as one of many partners. This model can help authorities disrupt networks earlier and understand attacks that cross national boundaries.

Cybercrime crosses borders easily because digital networks are not limited by national boundaries. Criminals can build infrastructure in one country, target victims elsewhere, and move proceeds through international channels. The article describes networks targeting victims across Asia and resources hosted in Africa or used against the region. That geography makes coordinated enforcement necessary.

Phishing can collect credentials and email addresses at scale. Business email compromise can exploit those credentials or trusted communication. Botnets provide connected resources for malicious activity, while criminal infrastructure lets operators maintain and repeat attacks. Cryptocurrency transactions can also help move or launder suspected proceeds. In Nigeria, one case involved about 2.1 million email addresses; another moved more than $2.4 million.

These tools make digital crime scalable because the same infrastructure can support many targets and transactions. Operation Serengeti III responded by combining threat intelligence, arrests, infrastructure disruption, and financial investigations. Its results show that cross-border cooperation is needed to match the networks’ reach.