Massive Interpol operation takes down 11,500 malicious networks in Africa

From crypto mining to inheritance scams, INTERPOL dismantles 11,500 cybercriminal infrastructures across Africa, arresting 1,200 suspects for scamming $485 million from thousands of victims.

The International Criminal Police Organization announced the multi-pronged takedown on Friday.

"Each INTERPOL-coordinated operation builds on the last, deepening cooperation, increasing information sharing, and developing investigative skills across member countries,” said Valdecy Urquiza, Secretary General of INTERPOL.

“With more contributions and shared expertise, the results keep growing in scale and impact. This global network is stronger than ever, delivering real outcomes and safeguarding victims," Urquiza said.

Participating in the coordinated crackdown – known as Operation Serengeti 2.0 – were cyber authorities from 18 African nations, the United Kingdom, and multiple private sector collaborators.

The three-month investigation, launched in June, was aimed at tackling “high-harm and high-impact cybercrimes, including ransomware, online scams, and business email compromise (BEC),” the INTERPOL announcement said.

With staggering results, the operation culminated in the arrest of 1,209 cybercriminals, the take down of 11,432 malicious infrastructures, and the recovery of 97.4 million USD.

Nearly 88,000 victims were said to have been targeted, with overall financial losses worth close to $485 million.

African authorities dismantle massive cybercrime & fraud networks.

In a sweeping INTERPOL-coordinated operation, authorities arrested 1,209 cybercriminals targeting nearly 88,000 victims. The crackdown recovered USD 97.4 million and dismantled 11,432 malicious infrastructures.

undefined INTERPOL (@INTERPOL_HQ) August 22, 2025

Operation highlights

The three African nations of Angola, Zambia, and Côte d'Ivoire were exposed as hotbeds of criminal activity, leading to the most disruptions.

In Angola, over two dozen cryptocurrency mining centers were discovered, run by 60 Chinese nationals, and mining and IT equipment worth more than $37 million.

The 60 suspects were found to be ”illegally validating blockchain transactions to generate cryptocurrency.”

Additionally, cyber police confiscated 45 illegal power stations used to generate the massive amounts of electricity needed to run the centers. Those illicit stations will now be used “to support power distribution in vulnerable areas,” INTERPOL said.

In Zambia, authorities arrested 15 individuals and seized key evidence, including domains, mobile numbers, and bank accounts – all being used for “a large-scale online investment fraud scheme” bilking 65,000 victims out of roughly $300 million.

“The scammers would lure victims into investing in cryptocurrency through extensive advertising campaigns promising high-yield returns. Victims were then instructed to download multiple apps to participate,” INTERPOL said.

In the Zambian capital of Lusaka, a suspected human trafficking network was also disrupted with the help of local Immigration authorities, leading to the seizure of 372 forged passports from seven countries.

Finally, in Côte d'Ivoire, cyber enforcement busted up a “transnational inheritance scam,” arresting the primary suspect, and “seizing assets including electronics, jewellery, cash, vehicles, and documents.”

The scam, said to have originated in Germany, would con victims into paying a fee to collect a fake inheritance. That fraud resulted in losses of an estimated $1.6 million.

In preparation for the launch, investigators worked with 36 other nations to beef up their cyber investigative skills as part of the International Cyber Offender Prevention Network project (InterCOP) led by the Netherlands.

The investigators participated in a series of hands-on workshops covering open-source intelligence tools and techniques, cryptocurrency investigations, and ransomware analysis, INTERPOL said.

The first Operation Serengeti crackdown, taking place in fall 2024, was also based on Africa’s Cyber Threat Assessment Report from that same year.

Curious what others think about this story? Contribute your thoughts to the debate below.