Operation Serengeti III: How INTERPOL’s Latest Sweep Compares With the Last Two

INTERPOL says Operation Serengeti III led to 1,462 arrests across 21 countries and the disruption of 10,909 malicious networks. The operation ran from 29 June to 31 August 2026, and INTERPOL published the results on 22 October 2026. Police also recovered more than USD 105 million and identified 65,929 victims.

The crime types are the part that matters for defenders. INTERPOL lists cyber-enabled fraud, ransomware, business email compromise (BEC), online scams and digital extortion. Those are the same threats that reach inboxes and brand names in Europe, Asia-Pacific and the United States.

How Does Serengeti III Compare With the Earlier Operations?

This is the third operation under the Serengeti name. INTERPOL called the 2025 edition Serengeti 2.0. The table below uses only the figures that INTERPOL printed in each release.

Arrests rose in each edition. The infrastructure row needs care. INTERPOL used different wording each year (“dismantled”, “disrupted”, “infrastructures and networks”), and the releases do not say how they count. Do not read the drop from 134,089 as a drop in criminal activity.

The recovered amount is also not a clean trend. The 2025 release gives USD 97.4 million recovered. The 2026 release gives more than USD 105 million recovered and, separately, losses linked to the activity of more than USD 385 million.

Which Crimes Did the Police Go After?

INTERPOL names five crime types and then gives cases. Each case maps to a threat that security teams in our markets also see.

• Investment and pension fraud. In Uganda, police dismantled two transnational fraud rings and arrested 365 foreign nationals. INTERPOL describes a rotating call-centre model with scripted calls, fake trading platforms and fraudulent websites, aimed at pensioners across Asia.
• Phishing and BEC. In Nigeria, one suspect was arrested for a large phishing and BEC operation. It harvested software credentials and gathered about 2.1 million email addresses.
• Investment fraud through messaging apps. A second Nigerian case followed more than USD 2.4 million in suspected proceeds. INTERPOL says much of it was laundered through cryptocurrency.
• Other fraud schemes. Tanzania dismantled a malicious mobile loan app scheme. Gabon disrupted a social media vehicle import fraud network. The Republic of Congo arrested 30 suspects.
• Illegal mining. In Angola, police dismantled two illegal cryptocurrency mining centres, arrested nine suspects and seized more than 2,000 mining devices and six illegal power transformation stations.

The release names ransomware as a target but gives no case, no group and no malware family. We cannot say which of the 1,462 arrests relate to ransomware.

Who Supplied the Intelligence?

Before the operation, investigators in 20 African countries and the United States received intelligence on suspicious domains, IP addresses and command-and-control infrastructure. INTERPOL says private partners supplied intelligence, technical analysis and operational expertise.

The partners named for Serengeti III are Group-IB, Kaspersky, Fortinet, TrendAI, Team Cymru, Uppsala Security and Cybercrime Atlas. The list also has Meta, the Global Anti-Scam Alliance and the Postal and Telecommunications Regulatory Authority of Zimbabwe. Fortinet, Group-IB, Kaspersky, Team Cymru, Uppsala Security and Cybercrime Atlas are also named in the 2024 and 2025 releases. Meta and the Global Anti-Scam Alliance are new to this list. The European Union and the Council of Europe co-funded the operation through the GLACY-e project.

What Can Your Security Team Take From It?

INTERPOL gives no defensive advice in the release. The points below are our reading, tied to the crime types it lists.

• BEC and phishing. In the Nigerian phishing and BEC case, the suspect harvested software credentials. Use phishing-resistant sign-in for mailboxes, alert on new forwarding rules, and confirm payment changes by a call to a known number. Our business email compromise glossary entry and the Operation reWired BEC sweep show how earlier police work looked.
• Scam sites that copy your brand. The Ugandan rings relied on fake trading platforms and fraudulent websites. Watch for new look-alike domains and report them early. See how to respond to lookalike and phishing domains.
• Ransomware. The operation shows that police received command-and-control domains and IP addresses before they acted. Feed the same kind of indicators into your own blocking and logging, and keep a tested plan such as our ransomware response playbook and checklist.
• Fast-moving money. The second Nigerian case involved laundering, much of it through cryptocurrency. If your finance team is tricked into a payment, tell your bank and the police within hours, because tracing proceeds depends on speed.

Customers and staff can also fall for the scams that police dismantled. A short note on phishing in your awareness material is cheap, and it names the lure, such as a fake pension or investment platform.

What Is Still Unknown?

INTERPOL says several investigations remain active. Authorities are still identifying more suspects, tracing proceeds and analysing digital evidence. The release does not publish indicators, domain lists or malware names, so there is nothing to block from it directly. The release also says the operation followed INTERPOL’s African Cyber Threat Assessment Report 2026, which points to artificial intelligence increasingly enabling cybercrime in Africa.