Operation Serengeti 2.0: Interpol against crypto criminals in Africa

Interpol announced the results of Operation Serengeti 2.0, a large-scale campaign against cybercrime across Africa, which demonstrated how large-scale, coordinated action can dismantle illegal activities. During the operation, 1209 people were arrested, more than 11 000 malicious infrastructures were eliminated, and nearly $100 million was recovered. GetBlock AML Research has published a brief overview of the operation.

The operation, which ran from June to August 2025, brought together investigators from 18 African countries and the UK to combat ransomware, online fraud, business email compromise, and other major threats. These types of crimes were identified as key risks in Interpol’s report “Cyber Threat Assessment in Africa.”

As part of the operation, international agencies, together with partners from the private sector, took massive action to counter these risks. Authorities seized fraudulent infrastructure, shut down illegal mining centers, and dismantled fraudulent networks operating in several countries simultaneously.

Interpol investigators used blockchain intelligence to expand the scope of the Serengeti 2.0 operation and strike faster at cybercriminal infrastructure. In Ghana, investigators followed leads linked to the Bl00dy group, an offshoot of the notorious Conti gang, which has attacked software in the education, healthcare, and government sectors around the world. Analysis showed that part of Bl00dy’s money laundering infrastructure was actively operating in the country, indicating the presence of an affiliate or operator on the ground.

Visualization: TRM Labs

Cryptocurrency laundering graph by the Bl00dy group

In the Seychelles, investigators used data on the RansomHub group, the new name for Knight ransomware, which has been rapidly expanding its operations since 2024.

Visualization: TRM Labs

RansomHub group’s on-chain activity

The results of the operation were significant. In Angola, authorities shut down 25 illegal cryptocurrency mining centers run by foreign nationals, seizing equipment and power stations worth more than $37 million. In Zambia, investigators cracked down on a major investment scam that victimized approximately 65 000 people, who lost a total of more than $300 million.

Source: Interpol

Confiscated fake passports in Zambia

In Côte d'Ivoire, authorities dismantled an international “inheritance” fraud scheme that originated in Germany, arrested the ringleader, and seized cars, cash, and luxury items. Across Africa, investigators confiscated fake passports, shut down fraud centers, and dismantled transnational criminal networks that had victimized nearly 88 000 people.