Threat intel

On October 22 Interpol announced the results of Operation Serengeti III, a crackdown on cybercrime run by police in 21 countries between June 29 and August 31, 2026. Officers arrested 1,462 suspects, disrupted 10,909 malicious networks and recovered more than USD 105 million. Interpol says investigators identified 65,929 victims, and financial investigations tied the groups to losses above USD 385 million.

Twenty of the participating countries are in Africa; the 21st is the United States. The targets were cyber-enabled fraud, ransomware, business email compromise (BEC, where a criminal poses as a supplier or executive by email to redirect a payment), online scams and digital extortion. Many of the victims were outside Africa: one Ugandan case alone involved victims across Asia. For a finance team anywhere, the cases show which schemes are still paying and which controls stop them.

What the operation found

Interpol published six cases in its release, and they cover most of the fraud a business is likely to meet.

• Uganda: police dismantled two transnational fraud rings and arrested 365 foreign nationals. The rings ran investment and pension fraud against victims in Asia, using rotating call centres, scripted calls, fake trading platforms and fraudulent websites.
• Nigeria, BEC: one suspect was arrested over a phishing and BEC operation that harvested software credentials and built a list of about 2.1 million email addresses. Police recovered a luxury car thought to have been bought with the proceeds.
• Nigeria, investment fraud: a second suspect was arrested over an international investment scheme promoted through messaging apps. More than USD 2.4 million in suspected proceeds moved through it, much of it laundered through cryptocurrency.
• Angola: two illegal cryptocurrency mining centres were shut down, with nine arrests and more than 2,000 mining devices and six illegal power transformation stations seized. Interpol values the electrical equipment at over USD 1 million.

Tanzania dismantled a malicious mobile loan app scheme, Gabon disrupted a vehicle import fraud network run through social media, and the Republic of Congo arrested 30 suspects. Interpol says several investigations are still open, to find more suspects, trace proceeds and analyse seized devices.

The participating countries were Angola, Benin, Cameroon, Congo, Côte d'Ivoire, DR Congo, Eswatini, Gabon, Gambia, Ghana, Kenya, Mozambique, Nigeria, Rwanda, Senegal, South Africa, Tanzania, Uganda, the United States, Zambia and Zimbabwe.

How the takedown worked

Before the arrests, Interpol gave investigators in the 20 African countries and the US intelligence on suspicious domains, IP addresses and command-and-control (C2) servers, the machines criminals use to run their phishing kits and malware. The "malicious networks" in the headline figure are this infrastructure, taken down or disrupted once it was mapped.

Most of that intelligence came from private companies. Interpol names Group-IB, Kaspersky, Fortinet, Team Cymru, Uppsala Security, the World Economic Forum's Cybercrime Atlas, Meta, the Global Anti-Scam Alliance and Zimbabwe's Postal and Telecommunications Regulatory Authority. Group-IB says it supplied data on phishing kits, botnets and other infrastructure hosted in Africa or used against it, plus social media accounts linked to suspected fraudsters. Jacomo Piccolini of Team Cymru put the method simply: criminals need infrastructure to operate, and building and maintaining it leaves traces that lead back to them. The operation was co-funded by GLACY-e, a European Union and Council of Europe project.

Interpol did not publish indicators of compromise (IOCs) such as domains or IP addresses, so there is no blocklist to import from this operation.

How the numbers compare

This is the third Serengeti operation. The first, in late 2024, made 1,006 arrests and took down 134,089 malicious networks and devices. Serengeti 2.0, from June to August 2025, made 1,209 arrests, disrupted 11,432 malicious networks and recovered USD 97.4 million, according to Interpol's partners and press coverage. Arrests and recoveries have risen each year. The network counts are not like-for-like, because the 2024 figure counted individual devices as well as networks.

Interpol's African Cyber Threat Assessment Report 2026, cited in the release, says artificial intelligence is increasingly enabling cybercrime in Africa and that cyber-enabled financial losses there are rising.

What to do

The Nigerian BEC case, with its 2.1 million email addresses and harvested credentials, is the pattern most businesses face. A list like that feeds phishing for mailbox logins. With a working login, the criminal reads invoice threads and then sends a "new bank details" email from the real mailbox or a lookalike domain.

Before money moves

1. Any request to change a supplier's or employee's bank details gets a call back to a phone number already on file, never one from the email that made the request. Write this into the accounts payable procedure so staff do not have to argue for it.
2. Require a second approver for any new payee, any change to an existing payee, and any payment above a threshold you set. Most finance systems and banking portals support dual authorisation; turn it on.
3. Put phishing-resistant multi-factor authentication (MFA), such as FIDO2 security keys or passkeys, on email accounts, starting with finance, executives and anyone who approves payments. Codes sent by text or typed from an app can be phished in real time.
4. Tag external email in the subject or banner, and alert on sender domains that look like your own or a key supplier's, such as one letter swapped.

When a fraudulent payment is found

Call your bank's fraud line as soon as the payment is spotted and ask it to recall the transfer and contact the receiving bank. Banks can freeze funds that have not yet moved on, and the receiving bank's cooperation is what makes a recall work.

Report to the police at the same time and ask them to raise it through Interpol if the money went abroad. Interpol's Global Rapid Intervention of Payments (I-GRIP) mechanism, launched in 2022, passes stop-payment requests between member countries. In 2024 a Singapore firm sent USD 42.3 million to a fraudster's account in Timor-Leste after a spoofed supplier email, and I-GRIP helped freeze about USD 39 million of it (reports of the final amount recovered vary slightly).

In the US, file at ic3.gov. The FBI's Recovery Asset Team runs the Financial Fraud Kill Chain for international wires of USD 50,000 or more that were sent within the last 72 hours and have a SWIFT recall already started. Report smaller or older transfers too.

Check the mailbox

Then find out how the criminal got the information. In Microsoft 365, list each affected user's inbox rules with Get-InboxRule -Mailbox <user> | Format-List Name,ForwardTo,RedirectTo,DeleteMessage,MoveToFolder, looking for rules that forward mail outside or move messages about invoices and payments out of sight. Search the unified audit log for New-InboxRule and Set-InboxRule operations, and review sign-ins for unfamiliar countries or IP addresses. If you find any, reset the password, revoke sessions, remove the rules and check which suppliers were on the threads the attacker could read, because they may be targeted next.

The wider lesson

Serengeti III disrupted 10,909 malicious networks and arrested 1,462 suspects, and the methods those groups used remain open to anyone else. The groups in this operation used fake trading sites, phishing kits and scripted calls, none of which require new technical skill. A business protects itself by making sure no single email can change where money goes, and by knowing who to call in the first hour after it goes wrong.

Our safeguarding and hardening work sets up mailbox MFA and the identity and logging baselines these checks depend on, and our security operations team writes detections for forwarding rules and suspicious sign-ins and handles the first hour when a payment goes missing. Open the chat and Yaali, our AI agent, will pass your question to an engineer.

---

Sources: Interpol, BleepingComputer, Help Net Security, The Hacker News, Hackread, Group-IB, CyberScoop on Serengeti 2.0, Infosecurity Magazine on the 2024 operation, BleepingComputer on I-GRIP, The Hacker News on I-GRIP, IC3 Financial Fraud Kill Chain, ALTA on the Kill Chain.