INTERPOL Arrests 574 in Africa; Ukrainian Ransomware Affiliate Pleads Guilty

INTERPOL says a law enforcement operation coordinated across Africa resulted in the arrest of 574 suspects from 19 countries and the recovery of $3 million, with the initiative named Operation Sentinel running from 27 October to 27 November 2025 and focusing on business email compromise, digital extortion and ransomware.

The crackdown reportedly saw more than 6,000 malicious links taken down and six distinct ransomware variants decrypted, with estimated losses linked to the incidents exceeding $21 million, though the names of the ransomware families were not disclosed.

In connection with the effort, authorities also dismantled a Ghanaian cyber fraud network and targeted a ransomware attack on an unnamed Ghanaian financial institution, among other actions; 10 people were apprehended in one Ghana/Nigeria operation, and Benin’s authorities dismantled 43 malicious domains and 4,318 social media accounts.

Neal Jetton, INTERPOL’s director of cybercrime, described the scale and sophistication of Africa’s cyber attacks as accelerating, particularly against finance and energy sectors; Operation Sentinel forms part of AFJOC, aimed at strengthening regional law enforcement capabilities.

Separately, a Ukrainian national pleaded guilty in the United States to conspiracy related to Nefilim ransomware as an affiliate, Artem Aleksandrovych Stryzhak, who was arrested in Spain in June 2024 and extradited earlier this April; he faces sentencing on 6 May 2026. According to the DoJ, Tymoshchuk, another Ukrainian national, was charged for operating LockerGoga, MegaCortex and Nefilim between 2018 and 2021, with a reward offer of $11 million and lists of most-wanted individuals from the FBI and the EU.