Team Cymru today announced its participation as a private-sector partner in INTERPOL’s Operation Serengeti III, a coordinated international law enforcement initiative targeting cybercriminal networks across Africa. The operation resulted in 1,462 arrests, the disruption of 10,909 malicious networks and the recovery of more than $105 million in illicit funds.

Team Cymru’s contribution reflects a fundamental advantage in combating cybercrime: the ability to see and understand the internet infrastructure that supports malicious activity, connecting signals across networks, geographies and criminal operations. Rather than examining threats as isolated incidents, infrastructure intelligence helps investigators identify relationship patterns, expose the systems enabling criminal activity, and prioritize opportunities for disruption.

“Criminals cannot operate without infrastructure. They have to build it, connect it and maintain it, and those activities create opportunities to find them,” said Jacomo Piccolini, VP Global Data Partnerships, Team Cymru. “Our ability to see attacker infrastructure at internet scale gives defenders a fundamentally different starting point. Instead of waiting for an attack and then investigating the damage, we can help expose the networks behind criminal operations and can enable defensive actions. Operation Serengeti III demonstrates the real-world impact of putting that intelligence in the hands of law enforcement.”

From Infrastructure Intelligence to Operational Impact

Conducted between June 29 and August 31, 2026, Operation Serengeti III brought together law enforcement agencies from 21 countries to combat cyber-enabled fraud, ransomware, business email compromise (BEC), online scams and digital extortion.

Authorities identified 65,929 victims and linked criminal activity to financial losses exceeding $385 million.

Ahead of the operation, participating investigators received actionable intelligence on suspicious domains, IP addresses and command-and-control infrastructure associated with criminal activity. Private-sector partners, including Team Cymru, supported the international effort with intelligence and technical expertise to help identify targets, map criminal networks, and advance investigations.

For Team Cymru, the value of infrastructure intelligence extends beyond identifying a suspicious IP address or domain. By understanding how infrastructure is connected, how it changes, and how attackers reuse resources, investigators can develop a broader picture of criminal operations. This allows defenders to move from reacting to individual threats toward understanding and disrupting the larger adversary systems that make individual threats possible.

Visibility into infrastructure is not simply about seeing more. It is about seeing earlier, understanding the connections, and enabling action that would otherwise be impossible.

Disrupting the Networks Behind Cybercrime

Operation Serengeti III produced significant law enforcement results across multiple countries, demonstrating the scale and complexity of the criminal operations being targeted.

  • Uganda: Authorities dismantled two transnational fraud rings and arrested 365 foreign nationals connected to online investment and pension fraud schemes.

  • Angola: Investigators shut down two illegal cryptocurrency mining centers, arresting nine suspects and seizing more than 2,000 mining devices.

  • Nigeria: Authorities arrested a suspect linked to a large-scale phishing and business email compromise operation involving approximately 2.1 million email addresses.

  • Additional operations: Law enforcement disrupted schemes involving malicious mobile lending applications, fraudulent vehicle imports and cryptocurrency-enabled investment scams.

While the methods and targets varied, the operation underscores a common challenge: cybercriminal networks span geographic boundaries, frequently operate through interconnected systems, and can adapt when individual components are disrupted.

Successfully combating these networks requires more than investigating individual incidents. It requires intelligence that helps reveal the broader criminal ecosystem and supports action against the infrastructure and operations sustaining it.

Seeing Earlier. Acting Together. Preventing Harm.

The operation comes amid growing concern about the scale and sophistication of cybercrime across Africa. INTERPOL’s African Cyber Threat Assessment Report 2026 highlights the expanding use of artificial intelligence in criminal activity and the continued rise of cyber-enabled financial losses.

As attackers become faster and more sophisticated, the time between infrastructure preparation and attack execution becomes increasingly important. The earlier defenders can identify and understand malicious infrastructure, the greater their opportunity to investigate, intervene and limit harm.

Team Cymru’s longstanding relationships with the global security community, combined with its internet-scale telemetry and infrastructure intelligence capabilities, support that mission by helping turn observations across the internet into actionable intelligence.

“These results represent an extraordinary collective effort by INTERPOL and the participating law enforcement agencies,” added Piccolini. “But they also reinforce something fundamental about cyber defense: you cannot disrupt what you cannot see. When investigators can understand the infrastructure and connections that sustain criminal networks, they gain opportunities to act beyond individual attacks. That’s why Team Cymru exists. We believe the greatest measure of intelligence is not simply what it reveals, but the harm it helps prevent.”

Several investigations stemming from Operation Serengeti III remain active as authorities continue identifying suspects, tracing illicit proceeds and analyzing digital evidence.

The operation was coordinated by INTERPOL and supported by private-sector partners, including Team Cymru, Group-IB, Kaspersky, Fortinet, Uppsala Security, Cybercrime Atlas, Meta, the Global Anti-Scam Alliance and the Postal and Telecommunications Regulatory Authority of Zimbabwe.

About Team Cymru

Since 2005, Team Cymru has operated some of the most comprehensive internet telemetry in the security industry. The company supports 180+ CSIRTs across 140+ countries through its Community Services program and maintains 1,000+ data sharing partnerships globally. Team Cymru’s in-house S2 Research Team provides the analyst-curated intelligence that powers the company’s Pure Signal™ Solutions.

Learn more at team-cymru.com.

Media gallery

About The Author
Business Wire