A coordinated international law enforcement operation has taken down nearly 11,000 criminal networks and seized more than $105 million in illegal proceeds, Interpol announced Thursday. The effort, codenamed Operation Serengeti III, ran from June 29 through August 31, 2026, and resulted in the arrest of 1,462 suspects across 21 countries. The operation targeted cybercrime infrastructure and networks operating primarily across Africa, with participating nations including Angola, Benin, Cameroon, Kenya, Nigeria, South Africa, Uganda, the United States, and 13 other countries.

Authorities dismantled 10,909 malicious networks and identified 65,929 victims who had been targeted by the criminal operations. Financial investigations traced criminal activity to losses exceeding $385 million, according to Interpol's statement. Key operational successes included breaking up two transnational fraud rings in Uganda that targeted victims across Asia through online investment and pension scams, leading to 365 arrests of foreign nationals. In Angola, authorities shut down two illegal cryptocurrency mining centers, arrested nine suspects, and confiscated 2,000 mining devices plus six illegal power transformation stations valued at over $1 million. Nigerian operations led to the arrest of one suspect connected to a phishing and business email compromise scheme that harvested software credentials and accumulated roughly 2.1 million email addresses, plus another suspect running an international investment fraud scheme that moved more than $2.4 million in suspected criminal proceeds, largely laundered through cryptocurrency. The Republic of Congo saw 30 arrests tied to a separate cybercrime operation.

"Cybercrime networks operate without regard for borders, exploiting technology to target victims on an unprecedented scale," said Neal Jetton, Interpol's director of cybercrime. The operation reinforces that while cybercrime is increasingly borderless, international cooperation remains one of the most effective tools for disrupting criminal networks, recovering criminal assets, and protecting communities from digital harm, according to Jetton. Private sector partners including Group-IB provided threat intelligence on phishing kits, botnets, and other malicious resources hosted in Africa or used to launch cyber attacks targeting the region. According to Jacomo Piccolini, vice president of Global Data Partnerships at Team Cymru, criminals can't operate without infrastructure they must build, connect, and maintain, and those activities create opportunities to locate them.

The operation's focus on infrastructure represents a shift from reactive investigation to proactive disruption. Rather than waiting for attacks to occur and then examining the aftermath, law enforcement agencies worked to expose the networks behind criminal operations and enable defensive measures before victims were harmed. The emphasis on infrastructure targets the foundational elements that cybercriminals need to conduct operations at scale—hosting services, command-and-control servers, payment processing channels, and communication platforms. Operation Serengeti III is the third wave in an ongoing series, following previous operations between September and October 2024, and June and August 2025, which together led to more than 2,000 arrests. The sustained campaign demonstrates that coordinated multinational efforts can dismantle criminal ecosystems that have historically exploited jurisdictional boundaries and enforcement gaps. For organizations operating in emerging markets or handling cross-border transactions, the operation underscores the growing alignment between public and private sector cybersecurity efforts—a partnership model that may redefine how enterprise risk teams anticipate regulatory cooperation and threat landscape evolution. The scale of victim identification also suggests that incident response protocols will need to account for multi-jurisdictional notification requirements as enforcement becomes more internationally synchronized.