• INTERPOL, AFRIPOL and the private sector conducted a cybercrime operation in 19 African countries between September and October.
• Operation Serengeti saw the arrest of 1 006 suspects and 134 000 operations.
• As many as 35 000 victims were targeted in these cybercrime operations.

More than 134 000 malicious networks and cybercrime infrastructure points were disrupted in a recent operation by INTERPOL and AFRIPOL. The operation, dubbed Operation Serengeti, also saw the arrest of 1 006 suspects across 19 countries.

Operation Serengeti was conducted between 2nd September and 31st October. Together with help from the private sector, INTERPOL and AFRIPOL targeted cybercriminals responsible for ransomware, business email compromise, digital extortion and scams. Over 35 000 victims were identified during the operation with losses amounting to $193 million worldwide.

The countries that participated in the operation included Algeria, Angola, Benin, Cameroon, Côte d’Ivoire, Democratic Republic of the Congo, Gabon, Ghana, Kenya, Mauritius, Mozambique, Nigeria, Rwanda, Senegal, South Africa, Tanzania, Tunisia, Zambia, and Zimbabwe.

“Operation Serengeti shows what we can achieve by working together, and these arrests alone will save countless potential future victims from real personal and financial pain. We know that this is just the tip of the iceberg, which is why we will continue targeting these criminal groups worldwide,” commented secretary general of INTERPOL, Valdecy Urquiza.

Some of the highlights noted by INTERPOL include disrupting a credit card fraud group in Kenya which stole around $8.6 million. Over a dozen arrests were made in that case so far.

Eight people running a Ponzi scheme in Senegal were also arrested. The scheme affected 1 811 victims, costing the $6 million. A search of the operation’s headquarters – an apartment – yielded 900 SIM cards, $11 000 in cash, phones, laptops and copies of victims’ IDs.

As mentioned, INTERPOL and AFRIPOL were assisted by the private sector. This includes internet service providers as well as cybersecurity firms Cybercrime Atlas, Fortinet, Group-IB, Kaspersky, Team Cymru, Trend Micro, and Uppsala Security.

In a press release Kaspersky says it contributed by sharing information on threat actors, data on ransomware attacks and malware targeting the areas the operation was being conducted in.

“Among the malware targeting African countries was also a well-known Brazilian banking trojan Grandoreiro – Kaspersky recently released new findings on this trojan at its Security Analyst Summit. Additionally, ransomware families detected in attacks on African organisations among others included LockBit, Rhysida, and Medusa,” the cybersecurity firm said in a press statement.

Cybercriminals hoping to take refuge in Africa may want to rethink that decision. While cybercrime is on the rise on the continent, its clear that law enforcement is also actively trying to strangle those operations.