Kaspersky provided threat intelligence for INTERPOL’s Serengeti III operation

International operation targets cyber-enabled crime

Kaspersky has announced support for INTERPOL-coordinated Operation Serengeti III, conducted between 29 June and 31 August 2026. The company says its Threat Research team provided intelligence and technical analysis to investigators working across 20 African countries and the United States.

According to the announcement, authorities arrested 1,462 suspects and seized assets valued at USD 105 million. Investigators identified approximately 66,000 victims and estimated losses linked to the activities under investigation at around USD 385 million. These figures describe the operation as reported in the announcement; suspects are not presented as having been convicted.

Intelligence on malicious infrastructure

The operation focused on threats including cyber-enabled fraud, ransomware, business email compromise, online scams and digital extortion. Kaspersky says its experts supplied information on infrastructure used for botnets and distributed denial-of-service attacks, together with phishing sites and malicious links targeting African users.

The company describes this work as supporting target identification, mapping of criminal networks and the preparation of investigations. INTERPOL Cybercrime Director Neal Jetton highlighted international cooperation as a means of disrupting cross-border networks and recovering criminal proceeds. Kaspersky public-affairs executive Yuliya Shlychkova likewise emphasised the need for cooperation across organisations and countries.

Examples reported from national investigations

In Uganda, authorities reported disrupting two international fraud networks and detaining 365 foreign nationals in connection with alleged investment and retirement scams targeting victims in Asia. In Angola, two illegal cryptocurrency-mining sites were closed and nine suspects were detained.

The announcement also describes Nigerian investigations into phishing, stolen software credentials and business email compromise. One case involved the collection of approximately 2.1 million email addresses; another concerned an alleged international investment scam conducted through messaging applications.

Investigations continue after the operation

Authorities also disabled approximately 11,000 malicious networks, according to the announcement. Some investigations initiated during Serengeti III remain open, with work continuing to identify further suspects, trace proceeds and examine digital evidence.

Kaspersky presents the operation as part of its continuing cooperation with law enforcement. Its stated contribution centred on threat intelligence and technical analysis, while investigative and enforcement actions were carried out by the participating authorities.