INTERPOL cybercrime crackdown nets 1,462 arrests, recovers Sh13.6bn

An international operation targeting cybercrime has led to 1,462 arrests, the shutdown of 10,909 malicious online networks and the recovery of more than $105 million in suspected criminal proceeds, as investigators uncovered cybercrime losses exceeding $385 million across 21 countries.

The operation, known as Operation Serengeti III, was coordinated by the International Criminal Police Organization (INTERPOL) and ran from June 29 to August 31, 2026. It targeted criminal networks suspected of carrying out online fraud, ransomware attacks, business email compromise, digital extortion and other crimes involving digital technology.

In an update released on Thursday, INTERPOL said investigators identified 65,929 victims who had been targeted by cybercriminal networks during the operation.

Financial investigations linked the criminal activities to losses of more than $385 million, highlighting the financial damage caused by online criminal schemes and the scale of the networks involved.

The crackdown brought together law enforcement agencies from 21 countries, including Kenya, Uganda, Nigeria, South Africa, Tanzania, Ghana, Rwanda and Zambia, alongside the United States and other participating nations.

Before the operation began, investigators received intelligence on suspicious internet domains, internet protocol addresses and command-and-control systems believed to be linked to criminal activities.

Private-sector partners also contributed technical expertise, intelligence and operational support, helping law enforcement officers identify targets, trace links between criminal networks and disrupt their operations.

INTERPOL Director of Cybercrime Neal Jetton said cooperation between countries remained essential in tackling criminal groups that use technology to reach victims across national borders.

“Cybercrime networks operate without regard for borders, exploiting technology to target victims on an unprecedented scale.

“Operation Serengeti III reinforces a clear message: while cybercrime is increasingly borderless, international cooperation remains one of the most effective tools for disrupting criminal networks, recovering criminal assets and protecting communities from digital harm,” Jetton said.

In Uganda, investigators dismantled two international fraud networks and arrested 365 foreign nationals suspected of involvement in online investment and pension fraud schemes targeting victims in several Asian countries.

The investigations uncovered a call-centre operation that used prepared scripts, fake trading platforms and fraudulent websites to convince pensioners to put money into investment opportunities that did not exist.

The findings pointed to an organised operation in which suspects allegedly used false investment offers and online platforms to deceive victims into handing over their money.

In Angola, authorities shut down two illegal cryptocurrency mining centres, arrested nine suspects and seized more than 2,000 cryptocurrency mining machines.

Officers also recovered six illegal power transformation stations linked to the mining operations. The seized electrical infrastructure was valued at more than $1 million.

In Nigeria, investigators arrested a suspect linked to a large-scale phishing and business email compromise operation. The network allegedly collected software login details and accumulated about 2.1 million email addresses.

Authorities also recovered a luxury vehicle suspected to have been bought using money obtained through criminal activities.

A separate Nigerian investigation focused on an international investment fraud scheme promoted through messaging applications. The operation led to the arrest of a suspect, while financial inquiries traced more than $2.4 million in suspected criminal proceeds.

Investigators found that a large portion of the money was allegedly moved through cryptocurrency transactions, which formed part of the financial trail being examined.

The crackdown also exposed other forms of cybercrime across the continent, including the misuse of mobile lending applications, vehicle import scams promoted through social media and wider online criminal operations.

In Tanzania, authorities dismantled a scheme involving a malicious mobile loan application, while investigators in Gabon disrupted a vehicle import fraud network that used social media to target victims.

In the Republic of Congo, authorities arrested 30 suspects linked to a cybercrime operation.

The cases showed the range of methods used by criminal networks, from fraudulent investment offers and stolen online credentials to illegal cryptocurrency mining and scams that exploit people's interest in buying vehicles or accessing loans.

INTERPOL said investigations arising from Operation Serengeti III were still active in several countries. Authorities were continuing to identify other suspects, trace suspected criminal proceeds and examine digital evidence recovered during the operation.

The operation comes amid growing concern about the changing nature of cybercrime across Africa, where criminal networks continue to use digital tools to target individuals, businesses and other organisations.

INTERPOL's African Cyber Threat Assessment Report 2026 points to an evolving cyber threat landscape, with artificial intelligence increasingly being used to support criminal activities and financial losses linked to cyber-enabled crimes continuing to rise.

The report's findings add to concerns about the ability of criminal networks to use technology to reach more victims and carry out schemes across several countries.

Operation Serengeti III received support from cybersecurity and technology organisations, including Group-IB, Kaspersky, Fortinet, Meta and the Global Anti-Scam Alliance.

The operation was co-funded by the Global Action on Cybercrime Enhanced project, a joint initiative of the European Union and the Council of Europe.

INTERPOL said the results demonstrated the importance of countries sharing intelligence and coordinating investigations to identify suspects, disrupt criminal networks, recover assets and protect people from online threats.

With several investigations still underway, law enforcement agencies are expected to follow up on leads, analyse the evidence collected and pursue additional suspects linked to the criminal activities uncovered during the operation.