1,209 Arrests and $97.4M Recovered in Africa...

Overview

An INTERPOL-coordinated crackdown across Africa—Operation Serengeti 2.0—resulted in 1,209 arrests, recovery of $97.4 million, and the dismantling of 11,432 malicious infrastructures. Running from June to August 2025, the operation targeted ransomware, online scams, and business email compromise (BEC), reflecting priorities from INTERPOL’s Africa Cyberthreat Assessment.

The action brought together investigators from 18 African countries plus the United Kingdom, supported by private-sector partners who provided indicators, tooling, and training that helped pinpoint offenders and infrastructure ahead of the action days.

Headline results

1,209 suspects arrested across participating countries
$97.4M recovered from fraud and related activity
11,432 hostile infrastructures (C2 servers, malicious domains, etc.) dismantled
Intelligence packages shared in advance (suspicious IPs, domains, infrastructure) guided field actions

Operational highlights

Angola — crypto-mining crackdown
Authorities shut down 25 unauthorized cryptocurrency mining centers where operators were illegally validating blockchain transactions. Police also seized 45 illicit power stations and $37M+ in mining/IT equipment, with assets earmarked to support power distribution in vulnerable regions.

Zambia — investment fraud & forged documents
Police dismantled a large online investment scheme that lured victims into crypto “high-yield” scams via heavy ad campaigns. Investigators identified ~65,000 victims with losses around $300M, arrested 15 suspects, and seized domains, mobile numbers, and bank accounts for follow-up actions (including overseas collaborators). In a separate operation, authorities disrupted a suspected trafficking hub and confiscated 372 forged passports from seven countries.

Côte d’Ivoire — inheritance scam takedown
Investigators broke up a transnational “inheritance” fraud with links to Germany. The alleged organizer was arrested, and police seized cash, vehicles, electronics, jewelry, and documents. Estimated victim losses: $1.6M.

Training, tooling, and prevention

Ahead of Serengeti 2.0, investigators completed hands-on workshops covering OSINT, cryptocurrency tracing, and ransomware analysis—practical skills that translated directly into operational wins. Prevention also featured prominently through the International Cyber Offender Prevention Network (InterCOP), a 36-agency consortium led by the Netherlands that aims to identify and disrupt emerging threats before they escalate.

Why this matters (OnionSpace view)

Large, coordinated actions like Serengeti 2.0 illustrate how financial tracing, infrastructure takedowns, and public-private collaboration now converge to hit cybercrime at scale. For researchers and privacy-minded users:

Expect short-term phishing spikes and tooling rebrands as disrupted actors try to regain footing.
Treat new “official” download links and recovery offers with caution—verify across multiple sources before engaging.
Keep Tor Browser updated, favor Safer/Safest security levels, and avoid installing add-ons that can weaken your fingerprinting defenses.

Partners & supporters

Operational partners: Cybercrime Atlas, Fortinet, Group-IB, Kaspersky, The Shadowserver Foundation, Team Cymru, Trend Micro, TRM Labs, Uppsala Security.
Funding: African Joint Operation against Cybercrime, supported by the UK Foreign, Commonwealth & Development Office.
Prevention: InterCOP (led by the Netherlands).

Participating countries

Angola, Benin, Cameroon, Chad, Côte d’Ivoire, Democratic Republic of Congo, Gabon, Ghana, Kenya, Mauritius, Nigeria, Rwanda, Senegal, South Africa, Seychelles, Tanzania, United Kingdom, Zambia, Zimbabwe.