From Serengeti to Serengeti III: What Three INTERPOL Operations Reveal

In 2025, a widely advertised scheme in Zambia prompted people to register on a series of apps with the promise of high investment returns. About 65,000 people signed up. By the time investigators caught on, losses had reached roughly $300 million.

Cases like this are why INTERPOL runs Operation Serengeti. Since 2024, three Serengeti operations have brought together law enforcement agencies from across Africa and beyond to identify and disrupt the networks behind consumer fraud, ransomware, and business email compromise. Team Cymru has supported all three Serengeti operations.

The window to prevent cybercrime opens far earlier than most people realize. Seeing into that window requires visibility into criminal infrastructure while it is still being built on the open internet, when the warning signs are already there but no one has been harmed yet. In INTERPOL’s hands, that internet-scale visibility has helped to protect the people these malicious networks set out to target.

Operation Serengeti by the Numbers, 2024–2026

On October 22nd, 2026, INTERPOL announced the results of  Operation Serengeti III. 

Across all three operations, that adds up to 3,677 arrests since 2024. Arrests have risen every year, from 1,006 to 1,209 to 1,462. Since INTERPOL began reporting recoveries in 2025, more than $200 million has been recovered.

What Changed from Serengeti to 2.0 to III

The first Serengeti showed what 19 countries could achieve by coordinating action and sharing intelligence against crimes whose reach extended across the African continent, to Brazil, China, the UAE, and many more.

Each subsequent operation has built on that foundation, becoming more intelligence-led and focusing on the recovery of stolen funds.

Serengeti 2024: 19 Countries, Shared Case Data, and a Model for What Followed

Operation Serengeti 2024 brought INTERPOL, AFRIPOL, and 19 countries together against ransomware, business email compromise, digital extortion, and online scams from a Ponzi scheme in Senegal to card fraud in Kenya. Participating countries pooled their case data, and INTERPOL turned it into 65 Cyber Analytical Reports and an intelligence base the later operations built on. 

Team Cymru was one of seven private-sector partners in that first operation.

Serengeti 2.0: Infrastructure Intelligence Moves to the Forefront

Before the 2025 operation began, INTERPOL sent participating countries intelligence on suspicious IP addresses, domains, and command-and-control servers. Investigators no longer had to work backward from a victim's complaint. They could start from observable attacker infrastructure. This is where Team Cymru's role deepened. 

We used Pure Signal™ to identify and categorize malicious infrastructure. Our tagging and S2 Threat Detections and Research teams then validated those findings, delivering high-confidence attributions of malicious servers and analysis of banking malware and phishing infrastructure.

Serengeti 2.0 also went after the proceeds of cybercrime. It was the first operation to report funds recovered, $97.4 million, with authorities seizing assets that kept criminal enterprises running. In Angola, law enforcement dismantled 25 illegal crypto-mining centers and confiscated 45 illicit power stations, along with mining and IT equipment worth more than $37 million.

Serengeti III: A Standing Partnership and a Record-Breaking Operation

Our partnership with INTERPOL didn't pause between Serengeti operations. 

In Operation Sentinel, our NetFlow analysis flagged tooling that may have preceded ransomware. And in July 2026, Team Cymru became an INTERPOL Gateway Partner. 

When Serengeti 3.0 began, investigators from across 21 countries again went in with actionable infrastructure intelligence. Team Cymru helped to identify targets, map criminal networks, and advance investigations. 

How Cyber Threat Actors Have Adapted

Throughout this three-year-period, law enforcement wasn't the only side learning. The criminals targeted by Serengeti have become more organized, more ambitious, and more skilled at masking their behavior.

Fraud has become a sophisticated business model.

What once looked like individual schemes now more closely resembles complex corporate operations, with recruitment pipelines, international staff, and multi-layered logistics workflows, with victims across multiple countries. Increasingly, many of the people managing these scams are victims themselves.

• In 2026, authorities in Uganda dismantled two transnational fraud rings and arrested 365 foreign nationals tied to online investment and pension fraud, with schemes built to drain people's retirement savings.
• In 2024, investigators in Cameroon found victims trafficked from seven countries, held against their will, and pressured to recruit others. In 2025, Zambian police seized 372 forged passports.
• INTERPOL's 2026 assessment found that 72% of African countries now report scam centers.

AI tools have accelerated the scale and speed of cybercrime

Africa now has more than 1.1 billion mobile subscribers, and that connectivity has created a vast pool of potential victims. AI has made that pool even easier and cheaper to reach. 

INTERPOL’s 2026 assessment found that AI is now linked to 55% of reported cybercrime across Africa. Losses have more than doubled since 2024, from $192 million to $484 million, driven largely by AI-enabled scams, credential harvesting, and automated social engineering.

• Business email compromise (BEC) has become harder to spot. AI can now write highly convincing emails, and Africa-based actors may use these emails to target victims in Europe and North America through infrastructure spread across multiple jurisdictions. During Serengeti III, Nigerian authorities arrested a suspect linked to a phishing and BEC operation involving approximately 2.1 million email addresses.

• Fake identities have become credible enough to pass real checks. Criminals combine authentic personal data with fabricated details to create synthetic identities that can get past biometric verification. And then use those falsified profiles to open bank accounts, take out mobile loans, and register SIM cards.

Why Infrastructure Visibility Matters to Every Operation

Despite advances in the development speed and scale of cybercrime, these operations still depend on internet infrastructure: domains to host lures, servers to run command and control, and networks to move stolen data and money. And all of it leaves a trace on the internet. These pre-attack signals can be seen while the infrastructure is still being built, long before the first probe reaches a victim.

Across Serengeti 2.0 and III, Team Cymru provided internet infrastructure visibility into more than 400 billion IP communications a day, illuminating the preparations of the specific networks investigators were targeting. The resulting intelligence helped to identify targets and map criminal networks, so law enforcement and partners could take infrastructure down before it could do further damage.

Our Continued Commitment to Protecting People and The Economies They Depend On

Several Serengeti III investigations are still active, as authorities continue to identify suspects and trace illicit proceeds. The work is far from finished.

The challenge ahead is as much about intelligence as enforcement. INTERPOL’s 2026 assessment points to a lack of real-time data sharing between banks, telecoms, and law enforcement as a blind spot that fraud actors continue to exploit, and it calls for formal public-private partnerships to eliminate that blind spot. Three Serengeti operations have shown what that kind of collaboration can achieve.

Every network taken down is a pension that stays intact, a local business that still makes payroll, and a family that can still count on the paycheck that keeps the lights on. That is the measure of this work that matters most, and it is why Team Cymru will continue to stand with INTERPOL and support their critical mission.

For Further Exploration

Read the official Operation Serengeti III announcement.

Or learn more about the Global Defender Exchange, the trusted community of defenders and data partners that enable the protection of people and critical infrastructure all over the globe, including the people spared from cybercrime because of Operation Serengeti.