What happened
INTERPOL announced on Thursday that a coordinated action across 21 countries disrupted 10,909 malicious networks, recovered more than $105 million in illicit funds and led to 1,462 arrests. Operation Serengeti III ran from June 29 to August 31, 2026.
The victim count stands out. Authorities identified 65,929 people targeted by the networks, and financial investigations linked the activity to losses exceeding $385 million. Participating countries were mostly African, with the United States also taking part.
The operational detail maps how online fraud pays. In Uganda, 365 foreign nationals were arrested and two transnational rings broken up over investment and pension schemes aimed at victims across Asia. Angola saw two illegal cryptocurrency mining centres dismantled, nine arrests, and 2,000 mining devices and six illegal power transformation stations worth over $1 million seized. In Nigeria, one suspect was arrested over a phishing and business email compromise operation that harvested software credentials and amassed about 2.1 million addresses, and another over an investment fraud advertised through messaging apps that moved more than $2.4 million, much of it laundered through cryptocurrency. Thirty suspects were arrested in the Republic of Congo.
Private sector partners fed the operation. Group-IB supplied intelligence on phishing kits, botnets and malicious infrastructure hosted in or aimed at the region. Team Cymru's Jacomo Piccolini said criminals have to build, connect and maintain infrastructure, and those activities create the opportunities to find them. Two earlier waves in 2024 and 2025 produced more than 2,000 arrests.
Why this is a GRC story
The loss driver is your own inbox. Business email compromise and credential harvesting sit at the centre, so the losses counted here arrived through ordinary mailboxes and software logins. A suspect holding 2.1 million addresses collected through software credentials is not a distant story about organised crime. It is a supply chain question about who can reach your accounts and what a credential issued to a third party can still do.
Recovery of $105 million against linked losses above $385 million shows that after the fact recovery covers a minority of harm. The controls that matter stop a payment or a session before it completes: callback verification for payment changes, conditional access on privileged accounts, and monitoring that treats a new mail rule as a signal rather than clutter.
The cash out step is instructive. The Nigerian cases and the Angolan mining seizure all end in conversion of proceeds into assets that move quickly, which is why firms touching digital assets carry monitoring obligations. The pattern also shows what structured intelligence sharing produces. Investigators started from infrastructure rather than victim complaints, which is a detective control organisations can replicate by watching their own exposed services.
What to watch
Arrests are not convictions, and the next year will show how many cases survive prosecution across 21 legal systems. Watch whether the credential set behind the 2.1 million addresses surfaces in breach notifications, because that is when affected organisations learn whether their access management held. And watch the annual rhythm: three waves in three years suggests a repeatable model, which makes the rebuilt criminal infrastructure the thing to track rather than arrest totals.
Attribution: Analysis based on The Hacker News and related public reporting. This article is original commentary, not a repost of the source material.