INTERPOL’s Operation Serengeti III secures two arrests in Nigeria and recovers $105 million across Africa

Overview INTERPOL disclosed on 22 October that its multinational effort, dubbed Operation Serengeti III, resulted in the arrest of two individuals in Nigeria. The operation, which ran from 29 June to 31 August 2026, targeted a range of cyber‑enabled crimes including phishing, business‑email compromise (BEC), ransomware and digital extortion. Across the 21 participating jurisdictions, authorities reported 1,462 arrests, the dismantling of 10,909 malicious networks and the seizure of illicit assets exceeding $105 million.

Nigerian arrests In Nigeria, investigators focused on two separate cases. One suspect was accused of operating a large‑scale phishing and BEC scheme that harvested software credentials and compiled roughly 2.1 million email addresses. The second suspect was linked to an international investment‑fraud operation promoted through messaging applications, with proceeds estimated at $2.4 million. Financial analysis indicated that a substantial portion of the illicit funds had been moved through cryptocurrency transactions. Police also recovered a luxury vehicle believed to have been purchased with the proceeds of the criminal activity.

Wider impact of Operation Serengeti III The broader operation affected 20 African nations and the United States. INTERPOL reported that the crackdown identified 65 929 victims targeted by cybercriminal networks and connected the disrupted activities to financial losses exceeding $385 million. In addition to the Nigerian cases, authorities in Uganda dismantled two transnational fraud rings, while in Angola illegal cryptocurrency‑mining facilities were shut down, resulting in the seizure of more than 2 000 mining devices. The coordinated effort highlighted the cross‑border nature of modern cybercrime and the growing role of artificial intelligence in facilitating attacks across the continent.

International cooperation and support Operation Serengeti III was underpinned by intelligence supplied by private cybersecurity firms such as Group‑IB, Kaspersky, Fortinet, Team Cymru and Meta. These organisations provided actionable data on suspicious domains, IP addresses and command‑and‑control infrastructure, enabling law‑enforcement agencies to act swiftly. INTERPOL’s director of cybercrime, Neal Jetton, noted that the operation demonstrated the capacity of multinational collaboration to disrupt sophisticated cyber‑criminal enterprises that disregard national boundaries.