What the operation reported
Law enforcement targeted business email compromise, ransomware and online scams. The headline figures are below.
- Arrests: 1,462 suspected cybercriminals.
- Networks dismantled: 10,909 malicious networks.
- Victims identified: 65,929, with estimated financial losses above $385 million.
- Funds recovered: Team Cymru's same-day announcement puts this at more than $105 million in illicit funds.
- Participants: Twenty of the countries were African and the 21st was the United States, according to Help Net Security.
The recovered funds are not the same as the losses. About $105 million came back against more than $385 million in estimated losses. That is roughly a quarter, and it is a rough comparison of two different measures.
Country-level cases
- Uganda: Authorities dismantled two transnational fraud rings and arrested 365 people tied to online investment and pension fraud. Team Cymru calls those arrested foreign nationals. Help Net Security reports rotating call centers, scripted pitches, fake trading platforms and fraudulent websites, and says the victims were in Asia.
- Angola: Investigators shut two illegal cryptocurrency mining centers, arrested nine suspects and seized more than 2,000 mining devices plus six illegal power transformation stations.
- Nigeria: One person was arrested over a large-scale phishing and BEC operation that harvested software credentials and amassed about 2.1 million email addresses, according to the quote in BleepingComputer's report. Team Cymru's version mentions the address count but not the credential harvesting. Neither source says all 2.1 million addresses belonged to victims or that every account was compromised.
- Other schemes: Actions also hit malicious mobile lending apps, fraudulent vehicle imports and cryptocurrency investment scams.
The infrastructure intelligence angle
This part matters most to defenders. Before the operation began, INTERPOL gave investigators intelligence on suspicious domains, IP addresses and command-and-control infrastructure. Private firms including Group-IB, Kaspersky, Fortinet, Team Cymru and Meta helped identify targets and map the networks.
Team Cymru's Jacomo Piccolini framed it this way: seeing attacker infrastructure at internet scale gives defenders a different starting point, because it exposes the networks behind attacks before the damage is investigated. That is a vendor describing its own contribution. The sources give no independent assessment of how much each partner mattered.
Context: the earlier operations
| Operation | Period | Arrests | Infrastructure dismantled | Money figure |
|---|---|---|---|---|
| Serengeti (2024) | Sept 2 – Oct 31, 2024 | 1,006 | 134,089 | INTERPOL cited cases tied to nearly $193 million in losses |
| Serengeti 2.0 (2025) | June – Aug 2025 | 1,209 | 11,432 | $97.4 million recovered |
| Serengeti III (2026) | June 29 – Aug 31, 2026 | 1,462 | 10,909 | $105 million+ recovered; $385 million+ losses |
The 2024 operation dismantled 134,089 malicious infrastructures and networks across 19 African countries. Almost $44 million was recovered, according to Security Boulevard's coverage. BleepingComputer repeats that recovery figure. The INTERPOL release I could review for 2024 reports the $193 million loss figure instead.
Arrests have risen each year, from 1,006 to 1,209 to 1,462. I would be careful about drawing a trend from the infrastructure counts. The 2024 total is more than ten times the later ones. The sources don't say whether counting methods or scope changed, and "networks" and "infrastructures" may not be the same unit. The 2025 release also credited a prevention partnership with InterCOP, a consortium of law enforcement agencies from 36 countries.
What the reporting doesn't tell us
- The sources don't list all 21 countries.
- They give no technical inventory of the dismantled networks.
- They don't give charges or court outcomes. Arrests are not convictions.
- They don't say that 10,909 networks means 10,909 separate criminal groups.
- Team Cymru says several investigations remain active as authorities continue identifying suspects, tracing proceeds and analyzing digital evidence. Further arrests and seizures are possible.
Practical takeaways for IT teams
The reporting contains no advisory or indicators of compromise. The following is general industry guidance, not something drawn from the operation's releases.
- Treat BEC as an identity problem. Credential harvesting feeds mailbox takeover. Phishing-resistant multifactor authentication and conditional access policies reduce the damage from stolen passwords.
- Watch for mailbox rule abuse. Check for new forwarding or inbox rules, and for unusual sign-in locations, in your mail platform's audit logs.
- Add a payment-change check. Require out-of-band verification, such as a call to a known number, before changing vendor bank details.
- Use threat intelligence feeds. The operation shows that early visibility into domains, IPs and C2 servers can help investigators. Defenders can apply similar feeds to block lists and detections.
- Review mobile and third-party app risk. The disrupted malicious lending apps are a reminder to control which apps can be installed on managed devices.
Bottom line
Operation Serengeti III is a large coordinated action with corroborated headline figures. Those figures come from INTERPOL's account as relayed by BleepingComputer, Help Net Security and Team Cymru's announcement. The arrest count is the clearest measure. The network counts are harder to compare across years. Many of the crimes involved, such as phishing, BEC and ransomware, are the same ones that reach business inboxes everywhere.