Interpol has reported the results of Serengeti III, six weeks of action against fraud, ransomware and extortion.
Between June 29 and August 31, 2026, agencies in 21 countries detained 1,462 suspects, disabled 10,909 malicious networks and clawed back more than $105M in illicit funds.
The victim count reached 65,929, and follow-the-money work tied those networks to losses past $385M.
Where the arrests happened
Uganda hosted one of the biggest takedowns: two cross-border fraud rings dismantled and 365 foreign nationals held over investment and pension schemes aimed at savers across Asia. Police found call centres steering victims to counterfeit trading platforms.
Angola produced a different result: two unlicensed crypto mining sites shut, nine suspects in custody, and hardware seized that included 2,000-plus rigs and six illegal power stations valued above $1M. In Nigeria, a phishing arrest came with about 2.1M harvested email addresses and a luxury car seized as suspected proceeds, while another case traced $2.4M from a messaging-app scam laundered through crypto. Tanzania handled loan app fraud, Gabon looked at vehicle import scams, and Congo detained 30 suspects.
What made the sweep work
Police did not start cold. Tips on shady domains, IP ranges and command-and-control servers went to 20 African countries and the United States, with private firms supplying analysis. Meta, TrendAI, Team Cymru, Uppsala Security, Cybercrime Atlas, Kaspersky, Fortinet and Group-IB were all named as partners.
One scheme can span a phishing site in one country, a server in another and mule accounts in a third. Closing it quickly turns a tip into a case.
What arrests do not prove
Several files remain open, and police are still tracing proceeds and analyzing seized devices. A high arrest count shows activity, not closure: it says nothing about groups finished, money returned to victims, or rivals rebuilding the seized kit.
