INTERPOL Serengeti III Leads to 1,462 Arrests in Africa

In Short

INTERPOL says Operation Serengeti III, a cybercrime crackdown across 20 African countries, led to 1,462 arrests and the recovery of $105 million.

What Happened

INTERPOL led the third edition of Operation Serengeti from 29 June to 31 August. The operation brought together investigators from across Africa and the US.

INTERPOL said the focus was cyber enabled fraud, ransomware, business email compromise, online scams, and digital extortion. Business email compromise, or BEC, is when attackers impersonate a trusted person or company to trick someone into sending money.

Authorities identified nearly 66,000 victims linked to the criminal networks targeted. Financial investigators estimated the victims’ losses at $385 million.

INTERPOL also said authorities disrupted nearly 11,000 malicious networks involved in cyber offences.

Uganda recorded the largest single haul. Authorities dismantled two transnational fraud rings and arrested 365 foreign nationals linked to online investment and pension fraud schemes targeting victims across Asia.

In Angola, investigators shut down two illegal cryptocurrency mining centres and arrested nine suspects.

In Nigeria, authorities arrested a suspect behind a large scale phishing and BEC operation that harvested software credentials and amassed about 2.1 million email addresses. A separate Nigerian investigation into an international investment fraud scheme promoted via messaging apps led to another arrest.

INTERPOL said cybersecurity firm Kaspersky was among the private sector partners that supplied threat intelligence. In the run up to the operation, Kaspersky’s Threat Research expertise centre gave investigators threat intelligence and technical analysis to help identify targets and map criminal networks.

INTERPOL said the support included data on network infrastructure used in botnet and distributed denial of service attacks, and on phishing and malicious URLs targeting African users. A distributed denial of service attack, or DDoS, is when attackers flood a service with traffic to knock it offline.

“Cybercrime networks operate without regard for borders, exploiting technology to target victims on an unprecedented scale,” said Neal Jetton, INTERPOL’s director of cybercrime.

Why It Matters

Operation Serengeti III shows how cross border investigations can combine arrests, network takedowns, and asset recovery. The victim and loss estimates also point to the scale of cyber enabled crime affecting people and businesses across Africa.