Team Cymru Supports INTERPOL's Operation Serengeti III, Disrupting Cybercriminal Networks Across Africa
Global operation results in 1,462 arrests, disruption of nearly 11,000 malicious networks and recovery of more than $105 million in illicit funds
LAKE MARY, Fla., October 22, 2026--Team Cymru today announced its participation as a private-sector partner in INTERPOL's Operation Serengeti III, a coordinated international law enforcement initiative targeting cybercriminal networks across Africa. The operation resulted in 1,462 arrests, the disruption of 10,909 malicious networks and the recovery of more than $105 million in illicit funds.
Team Cymru's contribution reflects a fundamental advantage in combating cybercrime: the ability to see and understand the internet infrastructure that supports malicious activity, connecting signals across networks, geographies and criminal operations. Rather than examining threats as isolated incidents, infrastructure intelligence helps investigators identify relationship patterns, expose the systems enabling criminal activity, and prioritize opportunities for disruption.
"Criminals cannot operate without infrastructure. They have to build it, connect it and maintain it, and those activities create opportunities to find them," said Jacomo Piccolini, VP Global Data Partnerships, Team Cymru. "Our ability to see attacker infrastructure at internet scale gives defenders a fundamentally different starting point. Instead of waiting for an attack and then investigating the damage, we can help expose the networks behind criminal operations and can enable defensive actions. Operation Serengeti III demonstrates the real-world impact of putting that intelligence in the hands of law enforcement."
From Infrastructure Intelligence to Operational Impact
Conducted between June 29 and August 31, 2026, Operation Serengeti III brought together law enforcement agencies from 21 countries to combat cyber-enabled fraud, ransomware, business email compromise (BEC), online scams and digital extortion.
Authorities identified 65,929 victims and linked criminal activity to financial losses exceeding $385 million.
Ahead of the operation, participating investigators received actionable intelligence on suspicious domains, IP addresses and command-and-control infrastructure associated with criminal activity. Private-sector partners, including Team Cymru, supported the international effort with intelligence and technical expertise to help identify targets, map criminal networks, and advance investigations.
For Team Cymru, the value of infrastructure intelligence extends beyond identifying a suspicious IP address or domain. By understanding how infrastructure is connected, how it changes, and how attackers reuse resources, investigators can develop a broader picture of criminal operations. This allows defenders to move from reacting to individual threats toward understanding and disrupting the larger adversary systems that make individual threats possible.