Interpol published the results of Operation Serengeti III on 22 October 2026: 1,462 arrests, 10,909 malicious networks disrupted, and more than USD 105 million in illicit funds recovered. South Africa was one of the 21 participating countries.
What happened
The operation ran from 29 June to 31 August 2026 and targeted cyber-enabled fraud, ransomware, business email compromise, online scams and digital extortion. Investigators identified 65,929 victims and linked the networks to losses above USD 385 million.
Private partners including Group-IB, Kaspersky, Fortinet and Team Cymru supplied intelligence on malicious domains, IP addresses and command-and-control infrastructure before the arrest phase began.
The detail that matters most to a finance department: in Nigeria, authorities arrested a suspect linked to a phishing and business email compromise operation that had collected roughly 2.1 million email addresses and harvested software credentials. Other actions included 365 arrests in Uganda over investment and pension fraud, and the seizure of more than 2,000 crypto mining devices in Angola.
Who is affected
- South African companies that pay suppliers or change bank details on the strength of an email
- Microsoft 365 and hosted mailbox tenants without enforced multi-factor authentication or conditional access
- Finance, property, logistics and professional services firms, the usual targets because they move money on instruction
- Any business whose staff email credentials have appeared in a credential-stuffing list or stealer log
What to do now
Treat every change of banking details that arrives by email as fraud until someone confirms it on a phone number you already had on file.
- Enforce MFA and conditional access on every mailbox, including shared and service accounts
- Audit mailbox forwarding rules, inbox rules that delete mail, and OAuth application consents
- Reset credentials for any account found in a stealer log, and check sign-in logs for impossible travel
- Give finance a written callback procedure with a second approver for payment instructions received electronically
- Watch for lookalike domains of your own suppliers and of your own domain
What this means for South African businesses
These arrests happened after the money moved, not before, and the losses linked to the networks ran to several times the amount recovered. The networks target small and mid-sized firms precisely because they carry no dedicated fraud team and rarely challenge an email that looks internal.
My read: a South African SME is far more likely to be hit by invoice fraud run out of one of these networks than by headline ransomware, and the loss usually sits outside insurance cover because a member of staff authorised the payment. Closing the identity gap on the mail tenant is the cheapest control available.
Source: Interpol - Cybercrime crackdown in Africa nets 1,462 arrests.
Also on the blog
Next step: If this is on your network or a client's, ask Matthews Enterprises to check exposure.