International law enforcement agencies have arrested 1,462 suspects and disrupted more than 10,900 malicious networks in a coordinated cybercrime operation spanning 21 countries, according to INTERPOL.
by Diana Zapata •
News Writer /Editorial Specialist
Published October 26, 2026
International law enforcement agencies have arrested 1,462 suspects and disrupted more than 10,900 malicious networks in a coordinated cybercrime operation spanning 21 countries, according to INTERPOL.
The operation, known as Operation Serengeti III, took place between June 29 and August 31, 2026. Authorities recovered more than $105 million in illicit funds and identified 65,929 people targeted by cybercriminal networks. Financial investigations linked the criminal activity to losses exceeding $385 million.
The crackdown targeted a range of cyber-enabled offenses, including online investment scams, ransomware attacks, business email compromise, digital extortion, and other forms of internet fraud.
The figures highlight the international reach of cybercrime and the difficulties investigators face when suspects, victims, financial transactions, and digital infrastructure are spread across national borders.
International Operation Targets Fraud Networks
Operation Serengeti III brought together law enforcement agencies from 20 African countries and the United States, with INTERPOL coordinating intelligence-sharing and investigative support.
Before the operation began, investigators received information about suspicious internet domains, IP addresses, and command-and-control infrastructure associated with suspected criminal activity. Private-sector cybersecurity partners also provided technical intelligence to help identify networks and support investigations.
Rather than targeting individual suspects alone, authorities sought to disrupt the infrastructure that enabled cybercriminal operations to function.
Such infrastructure can include fraudulent websites, phishing systems, compromised accounts, and networks used to communicate with victims or move stolen money.
INTERPOL said several investigations remain active, with authorities continuing to examine seized digital evidence, trace suspected criminal proceeds, and identify additional suspects. Arrest figures represent people detained during the operation, not necessarily individuals convicted of crimes.
Uganda: Suspected Investment and Pension Scams
One of the operation’s major enforcement actions took place in Uganda, where authorities dismantled two suspected transnational fraud networks and arrested 365 foreign nationals linked to alleged online investment and pension scams targeting victims across Asia.
Investigators reported finding call-center operations that used scripted communications, fraudulent websites, and fake trading platforms to persuade people to invest in nonexistent opportunities.
Such schemes can exploit the appearance of legitimacy. Fraudulent platforms may display fabricated account balances or apparent investment gains to encourage victims to transfer additional funds.
People approaching retirement can be particularly vulnerable when fraudsters present offers as reliable ways to protect savings or generate income. However, the reported operation involved a wider range of potential victims, and the full identities and circumstances of those affected have not been publicly established.
The arrests represent a significant enforcement action, but the investigation must still establish individual responsibility through evidence and appropriate legal proceedings.
Nigeria: Phishing and Financial Fraud
Investigators in Nigeria also pursued suspected cybercriminal operations involving phishing and business email compromise.
In one case, authorities arrested a suspect linked to an operation that allegedly harvested software credentials and collected approximately 2.1 million email addresses.
Business email compromise schemes often involve criminals impersonating employees, suppliers, executives, or other trusted contacts. Victims may be persuaded to disclose login credentials or transfer funds to accounts controlled by the perpetrators.
A separate Nigerian investigation focused on an international investment fraud scheme promoted through messaging applications. Authorities traced more than $2.4 million in suspected criminal proceeds, much of which was reportedly moved through cryptocurrency transactions.
The cases illustrate how traditional deception can be combined with digital tools and complex financial transfers to conceal the movement of suspected criminal proceeds.
Cryptocurrency Mining and Other Cybercrime Cases
The operation also targeted suspected illegal cryptocurrency mining facilities and other forms of online crime.
In Angola, authorities dismantled two illegal cryptocurrency mining centers, arrested nine suspects, and seized more than 2,000 mining devices. Investigators also confiscated six electrical transformation stations valued at more than $1 million.
Elsewhere, authorities reported disrupting a malicious mobile loan application scheme in Tanzania and a suspected vehicle-import fraud network operating through social media in Gabon. In the Republic of Congo, 30 suspects were arrested in connection with a cybercrime operation.
These cases demonstrate the range of activities covered by the operation. Cybercrime investigations increasingly involve financial fraud, identity theft, digital infrastructure, and the use of online platforms to reach victims.
More Than $105 Million Recovered, but Victim Losses Remain Substantial
The financial results of Operation Serengeti III show both the scale of the enforcement effort and the continuing challenge of addressing cybercrime losses.
Authorities reported recovering more than $105 million in illicit funds, while investigations linked the criminal activity to losses exceeding $385 million.
These figures measure different things. The recovered funds should not be interpreted as money already returned to every victim, and the reported losses do not necessarily represent a final accounting of all damage caused by the networks.
Recovering money can require investigators to trace transfers across financial institutions, digital wallets, and jurisdictions with different legal procedures. Even when funds are located, returning them to victims may involve additional legal and administrative steps.
The operation’s longer-term impact will therefore depend not only on arrests and network disruptions, but also on successful prosecutions, financial investigations, and efforts to prevent further victimization.
💬 Overall Takeaway: A Major Crackdown, but the Investigation Continues
Operation Serengeti III demonstrates the scale of international cooperation required to investigate cybercrime that crosses borders. The reported arrests, network disruptions, and financial recoveries represent substantial enforcement activity across 21 participating countries.
However, the operation does not mean the threat has been eliminated. Authorities continue to investigate cases, analyze evidence, trace suspected criminal proceeds, and pursue additional leads.
For the public, the cases offer a practical warning about online investment offers, unexpected payment instructions, suspicious links, and requests for sensitive account information. Independent verification remains essential before transferring money or disclosing financial credentials.
The central challenge is turning a large enforcement operation into lasting results: bringing evidence before the courts, disrupting criminal infrastructure, recovering funds where possible, and reducing the number of people who become victims of online fraud.
