Interpol’s Operation Serengeti III resulted in 1,462 arrests across 21 countries and disrupted 10,909 malicious networks linked to fraud, ransomware and business email compromise. For UK defenders, the real value is the infrastructure intelligence that made the arrests possible and what it means for their own detection work.
What happened
On 22 October 2026 Interpol published the results of Operation Serengeti III, the third round of its yearly crackdown on cybercrime groups based in Africa. The operation ran from 29 June to 31 August 2026 and brought together police from 20 African countries and the United States. It targeted investment and online fraud, ransomware, business email compromise (BEC) and digital extortion.
Interpol reports 1,462 arrests, 10,909 malicious networks disrupted and more than USD 105 million in criminal proceeds recovered. Investigators identified 65,929 victims and tied the offending to losses of more than USD 385 million. Interpol says several investigations are still open.
The participants included Nigeria, Ghana, Kenya, South Africa, Uganda, Tanzania and Angola, alongside the US. The UK was not among them. Funding came partly from GLACY-e, a programme run jointly by the EU and the Council of Europe.
The cases Interpol highlighted show how wide the operation was:
- Uganda: two transnational fraud rings were broken up and 365 foreign nationals arrested. The rings ran rotating call centres that targeted Asian pensioners with scripted pitches and fake investment platforms.
- Nigeria: one suspect is accused of a credential-phishing and BEC operation that built a list of about 2.1 million email addresses. In a separate case, an investment scam promoted on messaging apps led to one arrest, and investigators traced over USD 2.4 million, much of it laundered through cryptocurrency.
- Angola: police shut down two illegal cryptocurrency mining centres, arrested nine people and seized more than 2,000 mining rigs. They also seized six illegal power transformation stations.
- Elsewhere: a malicious loan app scheme was dismantled in Tanzania, a vehicle import scam run on social media was disrupted in Gabon, and 30 people were arrested in the Republic of Congo.
The technical picture
This was not a single botnet takedown with one sinkholed domain. The useful detail for defenders is how the targets were found. Before any arrests, Interpol gave investigators intelligence on suspect web domains, IP ranges and C2 servers. Private-sector partners, including Group-IB, Kaspersky, Fortinet, Team Cymru, TrendAI, Meta and Cybercrime Atlas, supplied intelligence and technical analysis.
Team Cymru’s own announcement describes the method in general terms: mapping the links between pieces of criminal infrastructure, tracking changes to it and spotting where operators reuse it, so that investigators can see whole operations instead of isolated incidents. “Criminals cannot operate without infrastructure,” said Jacomo Piccolini, the company’s VP of global data partnerships.
The figure of 10,909 “malicious networks” needs care. Interpol has not said what it counted, so it could include anything from phishing domains to hosting accounts. Read it as a measure of how far the operation reached, not as a count of servers seized.
The Nigerian case fits a familiar chain, although Interpol gave few details. Phishing at scale harvests credentials, the address list becomes a target list, and stolen logins can give access to genuine email threads that can be hijacked to redirect payments.
Why it matters for UK organisations
The UK did not take part in Serengeti III, and Interpol has not said whether any identified victims were British. That should be stated before anyone claims a UK win. The UK relevance is indirect but real.
First, the offending targeted here, BEC above all, is what hits UK businesses every week. A group gathering millions of email addresses is not restricting itself to local targets. Many UK firms buy from, sell to or employ staff in the countries involved, and invoice fraud travels easily along those trading links.
Second, in my professional view, much of the lasting value lies in the intelligence. When police and threat intelligence providers map criminal infrastructure at this scale, the indicators usually end up in the commercial feeds and blocklists UK security teams already use. Interpol has not confirmed this for Serengeti III.
Third, arrests deal with people and money, not methods. Phishing kits, call scripts and fake trading platforms cost little to rebuild, a limitation that applies just as much to the NCA’s own disruption work at home.
Expert view
Operations like this are easy to over-read in both directions. Some treat the totals as proof the threat has gone, and others dismiss them as public relations. When an annual operation keeps finding more than a thousand suspects, it shows how much fraud labour is available. It also shows that intelligence-led policing across a whole continent is now routine.
The point I would raise with any SOC lead is the sequence: infrastructure intelligence first, enforcement after. A mature detection team should work the same way on a smaller scale. When we test organisations for BEC exposure, the weak spots are rarely exotic. They tend to be unmonitored forwarding rules, weak multi-factor authentication on finance accounts and payment processes that trust an email at face value.
Cryptocurrency also features in several of the cases Interpol described, from illegal mining to laundering scam proceeds. Incident response teams that cannot follow a crypto trail, or do not know who can, will struggle to recover anything.
What to do now
- Harden finance mailboxes first. Require phishing-resistant multi-factor authentication for anyone who approves payments or edits supplier bank details. This falls under the Cyber Essentials user access control requirements.
- Hunt for mailbox persistence. Review inbox rules, external forwarding and newly consented OAuth apps in Microsoft 365 or Google Workspace. Alert on rules that hide messages mentioning invoices or payments.
- Check that intelligence reaches your controls. Make sure feeds update your email gateway, DNS filtering and web proxy automatically, and ask providers how quickly they add infrastructure exposed by law enforcement operations.
- Verify payment changes outside email. Confirm any bank detail change by phone, using a number already on file.
- Prepare the fraud response. Agree in advance who calls the bank, who reports to Action Fraud and who preserves mailbox logs.
- Brief staff on investment scams. Fake trading platforms target individuals, and compromised personal accounts often lead into corporate ones.
Bottom line
Serengeti III is a significant enforcement result, but the UK was not part of it and the techniques it targeted will survive the arrests. UK defenders should make use of the infrastructure intelligence such operations generate, and close the mailbox and payment gaps these criminals rely on.
