INTERPOL dismantles 10,909 cybercrime networks across Africa

INTERPOL coordinated Operation Serengeti III, which ran from June 29 to August 31, 2026, across 21 countries. Twenty participating nations were African, with the United States as the 21st member. Security forces arrested 1,462 suspects and dismantled 10,909 malicious networks. The operation recovered more than $105 million in illicit funds and linked the networks to over $385 million in losses affecting 65,929 victims.

The sweep targeted ransomware, online scams, digital extortion, and business e-mail compromise schemes. These crimes encompassed malicious mobile lending apps, fraudulent vehicle imports, and cryptocurrency investment schemes.

In June, Interpol’s African Cyberthreat Assessment Report 2026 documented cybercrime losses more than doubling since 2024 to USD$484 million. The report found that AI enables up to 55 percent of cybercrime in Africa, with scam centres operating in 72 percent of the 36 surveyed African member countries. The assessment described cybercrime as moving from isolated incidents toward an industrialized, borderless ecosystem.

AI-generated deepfakes and synthetic identities increasingly defeat biometric security measures. Criminals combine real personal data with fabricated elements to build synthetic identities capable of bypassing verification systems. Fraudsters have used such identities to open bank accounts, obtain mobile loans, and issue SIM cards under false identities.

East Africa serves as a hub for mobile money fraud and ransomware targeting infrastructure. Central and West Africa saw prolific business e-mail compromise and romance scam activity. Southern Africa’s connectivity draws global threat actors seeking major disruption. In 2025, online scams ranked as the most reported cybercrime category, and TrendAI recorded approximately 600,000 sextortion detections.

Before the operation began, INTERPOL shared intelligence on suspicious domains, IP addresses, and command-and-control servers. Cybersecurity companies including Group-IB, Kaspersky, Fortinet, Team Cymru, and Meta assisted with identifying targets and mapping networks.

The June 2026 assessment found that when banks, telecoms, and law enforcement fail to exchange data in real time, a dangerous gap opens up in financial fraud investigations. It called for stronger forensic standards, cross-border cooperation, and AI literacy training among police.

“Our ability to see attacker infrastructure at internet scale gives defenders a fundamentally different starting point,” said Jacomo Piccolini, Team Cymru’s VP of Global Data Partnerships. “International cooperation remains one of the most effective tools for disrupting criminal networks,” said Neal Jetton, INTERPOL’s Director of Cybercrime. Ugandan police dismantled two transnational fraud rings and detained 365 foreign nationals who ran rotating call centers and fake trading platforms. Their victims were in Asia.

Angolan investigators closed two illegal crypto mining centers, arrested nine people, and seized over 2,000 mining devices along with six unlawful power conversion facilities. The seized electrical equipment carried a value of more than $1 million.

Nigerian police detained a suspect accused of operating a phishing and business e-mail compromise scheme that gathered software credentials and 2.1 million e-mail addresses. A separate Nigerian investment fraud spread through messaging apps, resulting in one arrest and tracing over $2.4 million in suspected proceeds laundered through cryptocurrency.

Tanzanian police shut down a malicious mobile lending application scheme. Officers in Gabon disrupted a social media-based vehicle import fraud network. Republic of Congo police detained 30 suspects linked to a cybercrime operation.

The first Operation Serengeti ran across 19 African countries between September and October 2024, resulting in 1,006 arrests and the takedown of 134,089 malicious infrastructures. Operation Serengeti 2.0 ran between June and August 2025, producing 1,209 arrests, the dismantling of 11,432 malicious infrastructures, and $97.4 million in seizures.

Four coordinated INTERPOL operations during 2025 led to over 1,500 arrests and more than $100 million in recoveries. Seventeen African countries adopted new or amended cybercrime laws in 2025.

“Cybercrime has emerged as one of the most significant criminal threats to the region,” Jetton said. “AI is automating every stage of a cyberattack from reconnaissance and phishing to extortion and evasion.”

The assessment belongs to the African Joint Operation against Cybercrime initiative, funded by the United Kingdom’s Foreign, Commonwealth and Development Office. Data partners included Fortinet, Mastercard, the Shadowserver Foundation, S2W, and TrendAI. The report recommended that police receive AI literacy training and adopt stronger forensic standards, and it highlighted how the failure of banks, telecoms, and law enforcement to exchange data in real time leaves a dangerous gap in financial fraud investigations.