Team Cymru Supports INTERPOL’s Operation Serengeti 2.0 to Dismantle Cybercrime Networks Across Africa
Supporting law enforcement in the fight against cybercrime is core to Team Cymru’s mission to Save and Improve Human Lives. That’s why we were proud to contribute to INTERPOL's Operation Serengeti 2.0, a coordinated law enforcement effort that led to the arrest of 1,209 cybercriminals, the dismantling of 11,432 malicious infrastructures, and the recovery of $97.4 million USD connected to high-impact cybercrime across Africa.
Between June and August 2025, Operation Serengeti 2.0 brought together law enforcement from 18 African countries and the United Kingdom to target ransomware actors, investment fraud rings, human trafficking networks, and business email compromise (BEC) schemes. The operation was informed by intelligence gathered from INTERPOL’s Africa Cyberthreat Assessment Report, and it marks one of the largest cybercrime crackdowns ever conducted on the continent.
Operation Highlights
This operation spanned a range of threat types and geographies. According to INTERPOL, key outcomes included:
- Angola dismantled 25 illegal crypto mining centers, confiscating mining rigs, IT equipment, and 45 unauthorized power stations worth more than $37 million.
- Zambia uncovered a massive online investment fraud scheme that defrauded over 65,000 victims out of an estimated $300 million USD.
- A transnational inheritance scam originating in Germany was shut down by Côte d’Ivoire, recovering fraudulent documents, cash, jewelry, and electronics.
- Joint operations in Lusaka disrupted a human trafficking network, leading to the seizure of 372 forged passports and the shutdown of a scam center.
Unlike previous operations that primarily targeted online infrastructure, Serengeti 2.0 exposed the intersection of cyber and physical crime. From unauthorized crypto mining centers powered by illicit electricity, to forged passports linked to human trafficking networks, the operation underscored how deeply cyber-enabled crime can impact real-world systems and communities.
Our Role in the Operation
Team Cymru was one of nine private sector partners invited to contribute intelligence and technical support to Serengeti 2.0
Working alongside other partners, by identifying and categorizing malicious infrastructure using our own Internet telemetry data platform: Pure Signal. Our specialized Internet tagging team collaborated with our S2 Threat Research Team to research, assess, then validate their findings at the scale of the Internet that the operation needed for success. These efforts provided INTERPOL with high-confidence attributions of malicious servers and infrastructure.
Our methodology included:
- Implementing comprehensive analysis of banking malware and phishing infrastructure
- Categorizing Internet-facing nodes through our extensive tagging system
- Investigations into specific malware families
- Providing validated data to assist in the creation of threat intelligence reports
A Continued Commitment to Disrupting Global Cybercrime
Operation Serengeti 2.0 is just one of several international efforts Team Cymru has supported to help dismantle cybercriminal infrastructure and protect communities around the world. From Operation Endgame II, to the Synergia series (Operation I and Operation II), and the original Operation Serengeti (November 2024), we’ve partnered with INTERPOL, Europol, and other global stakeholders to provide infrastructure intelligence, threat validation, and attribution at scale.
Each operation builds on the last by expanding public-private collaboration, sharpening methodologies, and accelerating the disruption of malicious activity online and off. Serengeti 2.0 reinforced this approach by showcasing the real-world impact of sharing high-fidelity telemetry and threat intelligence across borders and sectors.
At Team Cymru, we remain committed to using our visibility, data, and expertise to protect individuals, businesses, and governments. Whether it's mapping infrastructure in real time or supporting global takedowns, we’ll continue to show up wherever cybercrime threatens the people behind the systems.
For more information on Operation Serengeti 2.0, read INTERPOL’s official press release.
