INTERPOL Operation Serengeti III: 1,462 arrests, 10,909 malicious networks disrupted and over $105M recovered across 21 countries
Matéria consolidada. Reúne 4 matérias que o Tifon tinha publicado separadamente sobre a mesma história. A IA reescreveu o relatório com o que as 3 fontes trouxeram em 24/10/2026 00:05; os links antigos trazem para cá.
Fontes: securityaffairs.com ↗ thehackernews.com ↗ bleepingcomputer.com ↗
INTERPOL announced the results of Operation Serengeti III on 22 October 2026. The coordinated action ran from June 29 to August 31, 2026 and targeted business email compromise (BEC), ransomware, online fraud, scams and digital extortion. It led to 1,462 arrests, the disruption of 10,909 malicious networks and the recovery of more than $105 million (bleepingcomputer.com, thehackernews.com, securityaffairs.com). Authorities identified 65,929 victims, and financial investigations tied the activity to losses above $385 million. Private partners including Team Cymru and Group-IB supplied threat intelligence, and Kaspersky and Fortinet are also named as supporters (bleepingcomputer.com); securityaffairs.com adds TrendAI, Uppsala Security, Cybercrime Atlas and Meta. This is the third wave, after operations in September-October 2024 and June-August 2025. Several investigations remain active, and securityaffairs.com cautions that arrests and takedowns do not show that networks are permanently dismantled or that victims will recover their money.
Detalhes técnicos
- Uganda: two transnational fraud rings were dismantled and 365 people were arrested over online investment and pension fraud (bleepingcomputer.com). The suspects were foreign nationals, and the victims were in Asia (thehackernews.com). The networks ran call centres that used scripts to push victims, including pensioners across Asia, into fake investment and pension trading platforms (securityaffairs.com).
- Angola: two illegal cryptocurrency mining centers were dismantled and nine suspects arrested. About 2,000 mining devices and six illegal power transformation stations were seized, with the electrical equipment valued at over $1 million (thehackernews.com, bleepingcomputer.com, securityaffairs.com).
- Nigeria: one suspect was arrested for a large-scale phishing and BEC operation that harvested software credentials and amassed about 2.1 million email addresses (all three sources).
- Nigeria: another case involved an international investment fraud scheme advertised via messaging apps. It moved more than $2.4 million in suspected proceeds, largely laundered through cryptocurrency (thehackernews.com, securityaffairs.com). thehackernews.com reports an arrest in this case.
- Republic of Congo: 30 suspects were arrested in connection with a cybercrime operation (thehackernews.com, securityaffairs.com).
- Tanzania: action against loan app fraud. Gabon: action against vehicle import scams (securityaffairs.com).
- The operation also hit malicious mobile lending apps, fraudulent vehicle imports and cryptocurrency investment scams (bleepingcomputer.com).
- Team Cymru and the other firms provided intelligence on suspicious domains, IP addresses and command-and-control (C2) infrastructure, which helped map criminal networks and identify suspects (bleepingcomputer.com). This intelligence was shared before the operation with investigators from 20 African countries and the United States (securityaffairs.com). Group-IB said its contribution covered phishing kits, botnets and other malicious resources hosted in Africa or used against the region (thehackernews.com).
- INTERPOL's 2026 African Cyber Threat Assessment Report highlights the growing use of AI to craft convincing messages and scale social engineering (securityaffairs.com).
- Earlier waves: the first Serengeti (Sept-Oct 2024, 19 countries) led to 1,006 arrests and about $44 million recovered. Serengeti 2.0 (June-Aug 2025) led to 1,209 arrests and $97.4 million seized (bleepingcomputer.com). Together the two earlier waves led to more than 2,000 arrests (thehackernews.com).
Remediação
securityaffairs.com gives no defender guidance. It stresses cross-border cooperation, public-private intelligence sharing and following the money as the main ways to disrupt these networks.
Relatos divergentes
- Scope: bleepingcomputer.com describes 21 African countries. thehackernews.com describes 21 countries mostly in Africa plus the United States. securityaffairs.com, the most recent, says law enforcement from 21 countries took part and that pre-operation intelligence went to 20 African countries and the United States, which fits the thehackernews.com version, although its own headline says 21 African countries. The exact make-up of the 21 participants is therefore not fully settled.
- Partners: bleepingcomputer.com lists Team Cymru, Kaspersky, Group-IB and Fortinet. thehackernews.com names only Group-IB and Team Cymru, introduced with "including". securityaffairs.com, the most recent, gives the longest list (Group-IB, Kaspersky, Fortinet, TrendAI, Team Cymru, Uppsala Security, Cybercrime Atlas and Meta), so the lists do not contradict each other.
Linha do tempo
-
INTERPOL Operation Serengeti III: 1,462 arrests, 10,909 networks disrupted and $105M recovered across 21 African countries
ler a análise desta fonte ocultar
INTERPOL announced the results of Operation Serengeti III, run between 29 June and 31 August 2026 with law enforcement from 21 countries. The operation led to 1,462 arrests, disrupted 10,909 malicious networks and recovered more than $105 million in illicit funds. It targeted online fraud, ransomware, business email compromise (BEC), scams and digital extortion. Investigators identified 65,929 victims, and financial investigations linked the activity to losses above $385 million. Several investigations remain active, and the article cautions that arrests and takedowns do not show that networks are permanently dismantled or that victims will recover their money.
Technical Details
- Uganda: two international fraud networks were broken up and 365 foreign nationals arrested. They ran call centres using scripts to push victims, including pensioners across Asia, into fake investment and pension trading platforms.
- Angola: two illegal cryptocurrency mining centres were shut down, nine suspects arrested, and over 2,000 mining devices and six illegal power stations seized (electrical equipment worth over $1 million).
- Nigeria: a suspect tied to phishing and BEC was arrested. The case involved stealing software credentials and collecting about 2.1 million email addresses. A separate case traced over $2.4 million from an investment scam promoted via messaging apps and laundered largely through cryptocurrency.
- Other actions covered loan app fraud in Tanzania, vehicle import scams in Gabon, and 30 arrests in the Republic of Congo.
- Pre-operation intelligence on suspicious domains, IP addresses and command-and-control infrastructure was shared with investigators from 20 African countries and the United States.
- Private partners supplied threat intelligence and technical analysis: Group-IB, Kaspersky, Fortinet, TrendAI, Team Cymru, Uppsala Security, Cybercrime Atlas and Meta.
- INTERPOL's 2026 African Cyber Threat Assessment Report highlights the growing use of AI to craft convincing messages and scale social engineering.
Remediation
The article gives no defender guidance. It stresses cross-border cooperation, public-private intelligence sharing and following the money as the main ways to disrupt these networks.
-
INTERPOL Operation Serengeti III: 1,462 arrests and 10,909 malicious networks disrupted across 21 countries
ler a análise desta fonte ocultar
INTERPOL announced the results of Operation Serengeti III, a coordinated law enforcement action run between June 29 and August 31, 2026 across 21 countries, mostly in Africa plus the United States. The operation led to 1,462 arrests, the disruption of 10,909 malicious networks and the recovery of more than $105 million in illicit funds. Authorities identified 65,929 victims, and financial investigations tied the criminal activity to losses above $385 million. Private sector partners including Group-IB and Team Cymru supplied threat intelligence on phishing kits, botnets and other malicious infrastructure. This is the third wave, following operations in September-October 2024 and June-August 2025, which together led to more than 2,000 arrests.
Technical Details
- Uganda: two transnational fraud rings disrupted and 365 foreign nationals arrested, linked to online investment and pension fraud targeting victims in Asia.
- Angola: two illegal cryptocurrency mining centers dismantled, nine suspects arrested, and 2,000 mining devices and six illegal power transformation stations seized (valued at over $1 million).
- Nigeria: one suspect arrested for a large-scale phishing and business email compromise (BEC) operation that harvested software credentials and amassed about 2.1 million email addresses.
- Nigeria: another suspect arrested for an international investment fraud scheme advertised via messaging apps, moving more than $2.4 million in suspected proceeds, largely laundered through cryptocurrency.
- Republic of Congo: 30 suspects arrested in connection with a cybercrime operation.
- Group-IB said its contribution covered phishing kits, botnets and other malicious resources hosted in Africa or used against the region.
-
Interpol's Operation Serengeti III disrupts 10,909 cybercrime networks and arrests 1,462 suspects across Africa
ler a análise desta fonte ocultar
Interpol announced the results of Operation Serengeti III, run between June 29 and August 31 with authorities from 21 African countries. The operation targeted business email compromise (BEC), ransomware and online scams. It led to 1,462 arrests, the dismantling of 10,909 malicious networks and the recovery of more than $105 million. Investigators identified 65,929 victims and estimated losses above $385 million. Private partners Team Cymru, Kaspersky, Group-IB and Fortinet supported the effort.
Technical Details
- In Uganda, two transnational fraud rings were dismantled and 365 people were arrested over online investment and pension fraud.
- In Angola, nine suspects were arrested and more than 2,000 devices were seized at illegal cryptocurrency mining centers.
- In Nigeria, one suspect was arrested for running a large-scale phishing and BEC operation that harvested software credentials and amassed about 2.1 million email addresses.
- The operation also hit malicious mobile lending apps, fraudulent vehicle imports and cryptocurrency investment scams.
- Team Cymru and the other firms supplied intelligence on suspicious domains, IP addresses and command-and-control (C2) infrastructure, which helped map criminal networks and identify suspects.
- Earlier iterations: the first Serengeti (Sept-Oct 2024, 19 countries) led to 1,006 arrests and about $44 million recovered. Serengeti 2.0 (June-Aug 2025) led to 1,209 arrests and $97.4 million seized.