OPERATION Serengeti III was an INTERPOL‑led crackdown across Africa that resulted in 1,462 arrests in 21 countries, with authorities disrupting 10,909 malicious networks and recovering more than USD 105 million. The operation ran from 29 June to 31 August 2026 and targeted a range of cyber-enabled crimes, including fraud, ransomware, business email compromise, online scams and digital extortion.
Investigators from 20 African countries plus the United States received pre‑operation intelligence on suspicious domains, IPs and command servers, with private sector partners such as Fortinet’s FortiGuard Labs and the World Economic Forum’s Cybercrime Atlas helping to identify targets and map networks. Investigators identified 65,929 victims and linked the networks to losses above USD 385 million; Fortinet notes that Serengeti I–III have cumulatively recovered about USD 246.4 million.
Key cases highlighted in the operation include Uganda, where police disrupted two fraud rings and arrested 365 foreign nationals linked to fake trading sites targeting pensioners in Asia; Angola, where two illegal crypto mining centres were shut, nine suspects arrested and more than 2,000 mining devices seized; and Nigeria, where officers arrested a suspect behind a phishing and BEC scheme that collected about 2.1 million email addresses and another arrest linked to an investment fraud of more than USD 2.4 million in proceeds.
Other disruptions affected Tanzania (malicious loan app scheme), Gabon (vehicle import scam) and the Republic of Congo (30 arrests). INTERPOL has not named suspects; the Ugandan rings are described as transnational. Investigations remain open, with tracing of funds and seized evidence ongoing, and INTERPOL flags that AI is intensifying cybercrime in Africa.