Group-IB provided INTERPOL with threat intelligence on malicious infrastructure and suspected fraudsters as part of Operation Serengeti III, a multinational law-enforcement initiative targeting cybercriminal networks across Africa. The operation led to 1,462 arrests, the disruption of 10,909 malicious networks and the recovery of more than USD 105 million in illicit funds.
Coordinated by INTERPOL from 29 June to 31 August 2026, the operation involved law-enforcement agencies from 21 countries. It targeted cyber-enabled fraud, ransomware, business email compromise (BEC), online scams and digital extortion. Authorities identified 65,929 victims, and financial investigations linked criminal activity to losses of more than USD 385 million.
Threat intelligence on malicious infrastructure
As part of the operation, Group-IB shared data with INTERPOL on phishing kits, botnets and other malicious resources hosted in Africa or used in cyberattacks against the region. The company also provided intelligence on threat actors suspected of involvement in fraud, including identified social media accounts linked to suspected fraudsters.
Group-IB has supported INTERPOL’s international work to identify and disrupt cybercriminal networks through intelligence sharing, investigative expertise and cooperation with law-enforcement agencies.
The operation took place against a changing cyber threat landscape in Africa. INTERPOL’s African Cyber Threat Assessment Report 2026 says artificial intelligence is increasingly enabling cybercrime, while financial losses linked to cyber-enabled crime continue to rise. The findings underline the role of intelligence sharing and coordinated action between law enforcement and private-sector cybersecurity partners.
Enforcement actions across Africa
The operation took place against a changing cyber threat landscape in Africa
In Uganda, authorities dismantled two transnational fraud rings and arrested 365 foreign nationals suspected of involvement in online investment and pension schemes targeting victims across Asia. Investigators found a rotating call-centre operation using scripted communications, fraudulent trading platforms and fake websites to persuade victims to invest in non-existent opportunities.
In Angola, police dismantled two illegal cryptocurrency mining centres, arrested nine suspects and seized more than 2,000 mining devices. They also confiscated six illegal power transformation stations, with the electrical infrastructure alone valued at more than USD 1 million.
Nigerian authorities arrested a suspect linked to a large-scale phishing and BEC operation that had collected about 2.1 million email addresses and harvested software credentials. A separate investigation into an international investment fraud promoted through messaging applications traced more than USD 2.4 million in suspected criminal proceeds, much of it laundered through cryptocurrency transactions.
Elsewhere, authorities in Tanzania dismantled a malicious mobile loan application scheme, while investigators in Gabon disrupted a social media-based vehicle import fraud network. In the Republic of Congo, 30 suspects were arrested in connection with a cybercrime operation. Several investigations are continuing as authorities identify suspects, trace proceeds and analyse digital evidence.
International cooperation against cybercrime
Group-IB CEO Dmitry Volkov said: "Cybercriminal networks continue to operate across borders, exploiting digital platforms and increasingly sophisticated techniques to target individuals and businesses worldwide," said Dmitry Volkov, CEO of Group-IB. "Operation Serengeti III demonstrates the importance of sustained cooperation between law enforcement and the private sector. By combining investigative expertise, actionable threat intelligence, and coordinated international efforts, we can help identify criminal networks, disrupt their operations, and prevent further harm. We are proud to continue supporting INTERPOL and its partners in our shared mission to fight cybercrime."
"Cybercrime networks operate without regard for borders, exploiting technology to target victims on an unprecedented scale. Operation Serengeti III reinforces a clear message: while cybercrime is increasingly borderless, international cooperation remains one of the most effective tools for disrupting criminal networks, recovering criminal assets and protecting communities from digital harm." — Neal Jetton, Director of Cybercrime at INTERPOL
Operation Serengeti III follows earlier editions of the initiative. In 2025, Operation Serengeti 2.0, also supported by Group-IB, resulted in 1,209 arrests, the disruption of 11,432 malicious networks and the recovery of USD 97.4 million. Group-IB shared intelligence on cryptocurrency investment scams, BEC infrastructure and malicious infrastructure operating across Africa, and provided practical training for investigators.
The ongoing partnership includes intelligence sharing, investigative assistance and capacity building to support international law enforcement efforts against digital crime.
Group-IB, a creator of predictive cybersecurity technologies to investigate, prevent, and fight digital crime, announced today that it supported INTERPOL's Operation Serengeti III, a multinational law-enforcement initiative targeting cybercriminal networks operating across Africa. The operation resulted in the arrest of 1,462 suspects, the disruption of 10,909 malicious networks, and the recovery of more than USD 105 million in illicit funds.
Coordinated by INTERPOL between June 29 and August 31, 2026, the operation brought together law-enforcement agencies from 21 countries to combat cyber-enabled fraud, ransomware, business email compromise (BEC), online scams, and digital extortion. Authorities identified 65,929 victims, while financial investigations linked criminal activity to losses exceeding USD 385 million.
Disrupting cybercriminal networks
As a long-standing INTERPOL partner, Group-IB continues to support international efforts to identify, investigate, and disrupt cybercriminal networks through threat intelligence sharing, investigative expertise, and cooperation with law enforcement.
As part of the operation, Group-IB provided INTERPOL with threat intelligence data on malicious infrastructure, including phishing kits, botnets, and other malicious resources hosted in Africa or used to conduct cyberattacks targeting the region. The company also shared intelligence on threat actors involved in fraudulent activities, including identified social media accounts linked to suspected fraudsters.
Private-sector cybersecurity partners
The operation comes amid an evolving cyber threat landscape across Africa. According to INTERPOL's African Cyber Threat Assessment Report 2026, artificial intelligence is increasingly enabling cybercriminal activity, while cyber-enabled financial losses continue to rise. The findings reinforce the importance of intelligence sharing and coordinated action between law-enforcement agencies and private-sector cybersecurity partners.
Operation Serengeti III targeted a wide range of cybercriminal activities, with significant enforcement actions across several African countries. In Uganda, authorities dismantled two transnational fraud rings and arrested 365 foreign nationals linked to sophisticated online investment and pension fraud schemes targeting victims across Asia. Investigators uncovered a rotating call-center model involving scripted communications, fraudulent trading platforms, and fake websites used to deceive victims into investing in nonexistent opportunities.
Power transformation stations
In Angola, law-enforcement agencies dismantled two illegal cryptocurrency mining centers, arresting nine suspects and seizing more than 2,000 cryptocurrency mining devices, alongside six illegal power transformation stations. The seized electrical infrastructure alone was valued at more than USD 1 million.
In Nigeria, authorities arrested a suspect linked to a large-scale phishing and business email compromise operation that had collected approximately 2.1 million email addresses and harvested software credentials. A separate investigation targeted an international investment fraud scheme promoted through messaging applications, uncovering the movement of more than USD 2.4 million in suspected criminal proceeds, much of which was laundered through cryptocurrency transactions.
Elsewhere, authorities dismantled a malicious mobile loan application scheme in Tanzania, disrupted a social media-based vehicle import fraud network in Gabon, and arrested 30 suspects linked to a cybercrime operation in the Republic of Congo. Several investigations remain ongoing as authorities continue to identify suspects, trace illicit proceeds, and analyse digital evidence collected during the operation.
Coordinated international efforts
"Cybercriminal networks continue to operate across borders, exploiting digital platforms and increasingly sophisticated techniques to target individuals and businesses worldwide," said Dmitry Volkov, CEO of Group-IB. "Operation Serengeti III demonstrates the importance of sustained cooperation between law enforcement and the private sector. By combining investigative expertise, actionable threat intelligence, and coordinated international efforts, we can help identify criminal networks, disrupt their operations, and prevent further harm. We are proud to continue supporting INTERPOL and its partners in our shared mission to fight cybercrime."
"Cybercrime networks operate without regard for borders, exploiting technology to target victims on an unprecedented scale. Operation Serengeti III reinforces a clear message: while cybercrime is increasingly borderless, international cooperation remains one of the most effective tools for disrupting criminal networks, recovering criminal assets and protecting communities from digital harm." — Neal Jetton, Director of Cybercrime at INTERPOL
Cryptocurrency investment scams
Operation Serengeti III builds on previous editions of the multinational initiative. In 2025, Operation Serengeti 2.0, also supported by Group-IB, resulted in 1,209 arrests, the disruption of 11,432 malicious networks, and the recovery of USD 97.4 million. Group-IB contributed intelligence relating to cryptocurrency investment scams, business email compromise infrastructure, and malicious infrastructure operating across Africa, alongside practical training for investigators.
The continued collaboration reflects Group-IB's commitment to supporting international law enforcement through intelligence sharing, investigative assistance, and capacity building to combat digital crime.
