Team Cymru Supports INTERPOL in Coordinated Operation Across Africa as Part of Operation Sentinel

Team Cymru is honored to have worked in close coordination with INTERPOL as a trusted private sector partner in Operation Sentinel. The operation, held under the umbrella of the African Joint Operation against Cybercrime (AFJOC), targeted business email compromise (BEC) schemes, digital extortion, and ransomware. 

This operation supported law enforcement in 19 countries across the continent. The coordinated action has led to 573 arrests, the recovery of $3 million USD, and the disruption of attacks-in-progress. Operation Sentinel, occurring from October 27 to November 27, took down over 6,000 malicious links and decrypted six distinct ransomware variants. 

Among the interventions carried out during Operation Sentinel were: 

• Halting the transfer of $7.9 million USD from a major petroleum company in Senegal after a sophisticated BEC scheme
• Identifying a ransomware strain and developing a decryption tool following a ransomware attack on a Ghanaian financial institution. This allowed for the recovery of nearly 30 terabytes of data and the arrest of multiple suspects. 
• Dismantling a cyber-fraud network operating across Ghana and Nigeria, leading to 10 arrests and the takedown of 30 fraudulent servers. 
• Taking down 43 malicious domains and 4,318 extortion scheme and scam-linked social media accounts in Benin, leading to 106 arrests. 

Operation Sentinel is a direct response to an acceleration in the scale and sophistication of cybercrimes within Africa, especially against critical sectors like energy and finance. Team Cymru is proud to have contributed to this operation by identifying relevant offensive security tooling within our NetFlow records that may have been precursors to ransomware.

An Ongoing Commitment to Saving and Improving Human Lives

Operation Sentinel is the latest example of our ongoing commitment to dismantling cybercriminal infrastructure and improving human lives globally. In November 2024 and August 2025, Team Cymru participated in Operation Serengeti and Operation Serengeti 2.0. These operations dismantled BEC and fraud rings operating in Africa, in addition to disrupting human trafficking rings. These operations recovered tens of millions of USD and led to the arrest of thousands of suspects. 

In 2023 and 2024, Team Cymru partnered with INTERPOL to provide infrastructure intelligence, threat validation, and attribution at scale to Operation I and Operation II of the Synergia series. These operations dismantled tens of thousands of cybercrime servers associated with phishing operations, information stealers, and ransomware. 

In collaboration with Europol and other global stakeholders, Team Cymru participated in multiple enforcement actions as part of Operation Endgame. These operations helped disrupt the versatile and persistent Trojan DanaBot, the Rhadamanthys infostealer, the remote access Trojan VenomRAT, and the brand new proxy botnet service Elysium. 

We are honored to continue to collaborate with our international partners and global security community. These operations continue to have real-world effects as they disrupt malicious activity both on and offline.