INTERPOL Operation Serengeti III: Transnational Cybercrime Crackdown Across 21 Countries

INTERPOL coordinated Operation Serengeti III from June 29 to August 31, 2026, disrupting 10,909 malicious networks across 21 jurisdictions, primarily in Africa. The operation dismantled infrastructure used for ransomware, business email compromise (BEC), and digital extortion, specifically targeting professional-grade fake investment platforms and fraudulent call centers used for social engineering. Technical collaboration with private-sector intelligence partners enabled the identification of 65,929 victims and the arrest of 1,462 suspects. Law enforcement recovered over $105 million of $385 million in attributed losses through coordinated asset tracing and network disruption.

• Operation Scope & Coordination

  • Multi-jurisdictional effort involving 20 African nations and one additional jurisdiction.
  • Collaboration with the Global Anti-Scam Association (GASA) to target cyber-enabled financial crime.
  • Execution window spanned from late June to August 2026.

• Technical Infrastructure & Attack Vectors

  • Disruption of 10,909 malicious networks supporting ransomware and BEC delivery chains.
  • Deployment of sophisticated, professional-looking trading websites to facilitate investment fraud.
  • Neutralization of fraudulent call centers used as operational hubs for high-volume social engineering.

• Impact Metrics & Financial Recovery

  • Execution of 1,462 arrests linked to organized transnational cybercrime syndicates.
  • Recovery of $105 million+ in illicit funds through advanced asset tracing and seizure.
  • Identification of 65,929 victims with total attributed losses exceeding $385 million.

• Private-Sector Intelligence Integration

  • Team Cymru provided critical network disruption support and real-time threat intelligence.
  • Group-IB and Bitdefender delivered investigative assistance and technical data on fraudulent platforms.
  • Mirage Security analyzed the operational mechanics of fake investment scam call centers.

• Defensive Implications & Mitigation

  • CISOs should monitor for anomalous domains mimicking professional trading and investment platforms.
  • Implementation of strict BEC detection rules targeting lateral movement and fraudulent payment requests.
  • Increased coordination with regional CERTs for the rapid takedown of malicious C2 infrastructure.