Interpol’s coordinated enforcement operation, known as “Serengeti 2.0,” resulted in the arrest of 1,209 alleged cybercriminals and assets worth $97.4 million. This significant scale operation represents a watershed moment in the fight against cyber-enabled crime across Africa. It sends a strong message to organized international criminal groups, as well as providing an opportunity to strengthen regional and global coordination.
A Benchmark Operation Across Eighteen Countries
In June to August 2025, approximately 200 law enforcement officers from 18 African countries participated along with the United Kingdom in “Serengeti 2.0” in response to rising cybercrime across the continent. According to Interpol, “Serengeti 2.0” accumulated over one thousand arrests, tracked down nearly 88,000 victims, and shut down over 11,400 malicious online elements underpinning modern digital crime.
The scale of the operation and its pace are attributed to the increasing maturity of intelligence-sharing arrangements between national law enforcement, private cybersecurity companies, and international partners. InfoSecurity Magazine noted that the “massive” law enforcement operation “recovered $97.4m in stolen money from more than 88,000 victims” while tackling ransomware, business email compromise (BEC), and online scams, the ugliest threats outlined in Interpol’s Africa Cyberthreat Assessment Report.
How Operation “Serengeti 2.0” Played Out
Serengeti 2.0, funded by the UK’s Foreign, Commonwealth and Development Office, was operated under the auspices of the African Joint Operation Against Cybercrime. The investigators from multiple countries including Angola, Zambia, Côte d’Ivoire, Nigeria, Ghana, Kenya, South Africa, among others, maximized collective energy in investigating both immediate and future cybercrime threats.
Key tactical victories include:
- Dismantled 25 illegal cryptocurrency mining centers in Angola, operated by 60 Chinese nationals and seized mining equipment and power stations valued at $37 million which can be used by vulnerable populations.
- Disrupted a US$300 million investment fraud scheme in Zambia involving a recognized total of at least 65,000 victims whereby victims were recruited via fake cryptocurrency ads and malicious apps. In relation to this matter, Zambian police have arrested at least 15 suspects and seized assets of approximately US$300 million, frozen bank accounts, and digital domains.
- Disrupted a transnational inheritance scam that originated in Germany with impact in the region, which law enforcement disclosed was neutralized within Côte d’Ivoire. Cash, vehicles, electronics seized, and hierarchy member detained. Losses in this matter approx. US$1.6 million.
- Seized hundreds of forged global international passports and disrupted scam date centers involved in human trafficking elements.
Valdecy Urquiza’s, Secretary General of Interpol is quoted as saying the operation was a success:
“Each operation coordinated by Interpol is cumulative and adds to the collective cooperation and information sharing… It’s an effective global network that is delivering tangible outcomes and protecting victims.”
Collaboration: The Secret Source of Disruption
A strength of Serengeti 2.0 was the unprecedented application of private sector experts and international NGOs. Cybersecurity companies such as Kaspersky, Fortinet, Group-IB, and blockchain analysis companies like TRM Labs provided actionable threat intelligence, including indicators of compromise, insights into the ransomware group negotiating with us and host damage information.
For example, Group-IB provided “circumstantial intelligence” on a cryptocurrency investment scam, while TRM Labs tracked and identified functions related to laundering tied to infamous ransomware gangs (Bl00dy and RansomHub) through Ghana and the Seychelles. The fusion of police work and technology allowed for a quicker and more accurate offline delivery taking it to a new level of what could be achieved with international coordination of policing cybercrime.
A Roadmap for Global Cybercrime Preparedness
The success of “Serengeti 2.0” is not just in the sheer numbers, but a clear indication of what can be achieved with intelligence, coordination, and cross-sector collaboration. For example, Kaspersky intercepted 10,000 unique ransomware samples in Africa from January to May 2025, evidence of both the community’s vulnerability and of the emerging capabilities of law enforcement.
Victims directly affected by the criminal networks targeted in the two-month operation totaled more than 87,858, and losses attributed to these groups totaled more than $480 million. Interpol and its partners’ recoveries of $97.4 million and disruption of infrastructure will have decreased ongoing losses and improved digital safety for millions.
Looking Forward: New Era of Digital Security
As cybercrime continues to evolve—spanning borders and exploiting digital divides—transnational operations such as Serengeti 2.0 provide a precedent. Prevention will always be paramount; the International Cyber Offender Prevention Network is now operational in 36 countries.
The reverberations of the operation will likely be felt for some years to come, now more than ever, and serve as a timely reminder of the need to be diligent in a digital world.