Overview
INTERPOL just wrapped Operation Sentinel—574 arrests across 19 African countries, $3 million recovered, six ransomware variants decrypted. The month-long blitz stopped a $7.9 million heist against a Senegalese oil company hours before the money vanished. It's the latest in an escalating campaign: three cybercrime operations arrested 2,789 suspects and recovered $147 million since September 2024, while a new terror financing operation identified $260 million in suspicious flows and made 83 arrests across six countries.
Africa has become ground zero for business email compromise fraud and increasingly, cryptocurrency-enabled terror financing. Two-thirds of African countries report cyber-related crimes account for a medium-to-high share of all crime. INTERPOL's response: back-to-back operations bringing together investigators from dozens of countries, private sector tech firms (Team Cymru, Binance, Uppsala Security), and millions in UK and EU funding. The model is expanding—Operation Catalyst marked the first time financial crime, cybercrime, and counter-terrorism units joined forces continentwide, while a new African Development Bank partnership targets the $90 billion annual corruption drain.
Key Indicators
People Involved
Organizations Involved
Global police cooperation organization coordinating the African Joint Operation against Cybercrime framework.
The African Union's technical institution for strengthening law enforcement cooperation across 55 member states.
UK government department funding INTERPOL's African cybercrime enforcement through AFJOC and GLACY-e.
FBI's cybercrime complaint and intelligence center documenting the global BEC threat.
Pan-African development finance institution providing financing and expertise for economic development projects across the continent.
Global cryptocurrency exchange providing transaction intelligence and virtual asset tracing for Operation Catalyst.
Japanese cybersecurity firm specializing in blockchain intelligence and threat detection.
Timeline
-
AFRIPOL Sixth NLO Meeting in Algiers
Conference40+ AU member states discuss cybercrime training, digital connectivity, and continental data sharing amid 3,153 weekly cyberattacks (61% above global average).
-
Catalyst Results: 83 Arrested, $260M in Suspicious Flows
MilestoneTerror financing operation identifies $260M in fiat and virtual currencies linked to terrorism, seizes $600K, arrests 83 across six countries.
-
INTERPOL African Regional Conference in Cape Town
Conference188 senior police leaders from 56 countries convene to address transnational organized crime, sharing expertise and best practices.
-
Operation Catalyst Launches
OperationFirst joint financial crime, cybercrime, and counter-terrorism operation begins across six African countries targeting terror financing networks.
-
INTERPOL Partners with African Development Bank
PartnershipFirst multilateral development bank to collaborate with INTERPOL signs letter of intent targeting $90 billion annual corruption and financial crime losses.
-
INTERPOL Announces Sentinel Success
StatementPublic announcement of Operation Sentinel results highlights $21M in losses linked to investigated cases.
-
Sentinel Results: 574 Arrested, 6 Ransomware Variants Decrypted
MilestoneOperation concludes with 574 arrests, $3M recovered, 6,000+ malicious links down, 4,318 social media accounts shut.
-
Ghana Decrypts 30TB of Ransomware Data
TechnicalGhanaian investigators develop decryption tool recovering 30TB after ransomware encrypts 100TB at financial institution.
-
Senegal Stops $7.9M Oil Company Heist
InvestigationBEC attackers impersonate petroleum company executives; Senegalese authorities freeze accounts before transfer completes.
-
Operation Sentinel Begins
Operation19 countries launch month-long operation targeting BEC, digital extortion, and ransomware with enhanced private sector support.
-
Serengeti 2.0: 1,209 Arrested, $97.4M Recovered
MilestoneSecond operation arrests 1,209 suspects, dismantles 11,432 infrastructures, uncovers $300M Zambian investment fraud.
-
Operation Serengeti 2.0 Launches
Operation18 African countries plus UK begin three-month operation targeting high-impact cybercrimes.
-
INTERPOL Reports Sharp Rise in African Cybercrime
Report2025 Africa Cyberthreat Assessment warns two-thirds of countries report medium-to-high cyber-related crime share.
-
Valdecy Urquiza Becomes Secretary General
LeadershipBrazilian Police Commissioner appointed INTERPOL Secretary General, intensifies African cybercrime focus.
-
Serengeti Results: 1,006 Arrested
MilestoneOperation concludes with 1,006 arrests, 134,089 malicious networks dismantled, $44M recovered from $193M in linked losses.
-
Operation Serengeti Begins
Operation19 African countries launch two-month operation targeting ransomware, BEC, and digital extortion networks.
-
Operation Nervone Arrests OPERA1ER Figure
InvestigationKey figure from OPERA1ER cybercrime group targeting African financial institutions arrested.
-
Africa Cyber Surge I Launches
OperationFirst transnational African cybercrime operation identifies thousands of at-risk infrastructures, coordinated from INTERPOL command center in Kigali.
Scenarios
Enforcement Overwhelms Networks, BEC Declines
Discussed by: Implied by INTERPOL operational strategy and Urquiza's emphasis on sustained capacity building
Continuous operations force cybercrime networks to relocate or collapse faster than they can rebuild. INTERPOL's model—operations every few months, each building investigative skills in member states—creates sustained pressure. Private sector partnerships provide persistent technical intelligence. West African BEC operations migrate to other regions or abandon high-value corporate targets for lower-risk scams. African cybercrime share drops from 30% toward global average over 2-3 years. Requires sustained UK/EU funding and member state commitment.
Networks Adapt, Enforcement Catches Low-Level Operators
Discussed by: Critics of Nigerian enforcement noted by cybercrime researchers; pattern seen in 'Yahoo Boys' crackdowns
Operations arrest hundreds of low-level fraudsters while masterminds evade capture and networks reconstitute. BEC infrastructure becomes more distributed and harder to trace. Criminals shift from email compromise to harder-to-track methods like messaging apps and encrypted communications. African countries make arrests but lack resources for complex prosecutions. Operations become performative—good press releases, minimal lasting impact. This mirrors Nigerian EFCC crackdowns that arrest small-time operators while sophisticated networks persist.
Operations Expand Globally, Target Receiving Countries
Discussed by: IC3 data showing UK, Hong Kong, China as intermediary stops; international banking pattern analysis
INTERPOL applies African operation model to receiving countries where stolen funds land—UK, Hong Kong, UAE, China. Operations shift from arresting senders to freezing receiving accounts and prosecuting money launderers. International banks face pressure to implement better BEC detection. G7 countries mandate real-time verification for high-value corporate transfers. BEC remains prevalent but average heist size drops as banks catch transfers before completion. This leverages the Senegal petroleum case as proof-of-concept.
Funding Dries Up, Operations Slow
Discussed by: Dependency on UK FCDO and EU funding noted across all operations
UK or EU budget cuts eliminate AFJOC funding. Operations become smaller, less frequent. African countries lack resources to sustain enforcement without external support. INTERPOL coordination diminishes. Cybercrime networks regroup during enforcement gaps. BEC losses climb back toward previous levels. AFRIPOL attempts to fill gap with regional funding but lacks INTERPOL's global reach and private sector partnerships. African member states prioritize other threats over cybercrime.
Terror Financing Model Expands to Other Continents
Discussed by: Implied by Operation Catalyst's success in multi-unit coordination and private sector crypto intelligence
Operation Catalyst's model—financial crime, cybercrime, and counter-terrorism units working together with cryptocurrency firms like Binance providing transaction intelligence—proves effective at tracing virtual asset flows to terrorist networks. INTERPOL replicates the framework in Southeast Asia, Middle East, and South America where crypto-enabled terror financing is growing. The $260 million identified in Africa provides proof-of-concept for global expansion. Virtual asset service providers face increased pressure to implement real-time monitoring and reporting. Success depends on whether countries outside Africa will allow similar cross-unit coordination.
Historical Context
Operation Avalanche (2016)
2016What Happened
Forty countries coordinated to dismantle the Avalanche cybercrime network, seizing and sinkholing over 800,000 malicious domains in what prosecutors called the largest-ever cybercriminal infrastructure takedown. The network had operated since 2010, controlling 500,000 infected computers daily and causing hundreds of millions in losses worldwide.
Outcome
Short term: Unprecedented disruption of major botnet infrastructure through coordinated sinkholing.
Long term: Established template for multi-country cybercrime operations requiring real-time coordination across 30+ jurisdictions.
Why It's Relevant
Proved international cooperation can dismantle sophisticated networks. INTERPOL's African operations use similar coordination but occur repeatedly rather than as one-off events, applying lessons about sustained pressure.
Europol J-CAT Formation (2014)
2014-presentWhat Happened
Europol established the Joint Cybercrime Action Taskforce, placing cyber liaison officers from multiple countries at a single headquarters in The Hague. J-CAT coordinates ongoing operations against ransomware, botnets, and identity theft rings, with 18 officers from 16 countries working together permanently.
Outcome
Short term: Enabled rapid multi-country operations like Magnus (RedLine infostealer takedown) and Triangle.
Long term: Created permanent infrastructure for cybercrime cooperation rather than ad-hoc arrangements, now expanding beyond Europe.
Why It's Relevant
INTERPOL's African operations mirror J-CAT's model—sustained cooperation building investigative capacity rather than one-off raids. The African Cybercrime Operations Desk functions like a continental J-CAT.
Nigerian 'Yahoo Boys' Enforcement Pattern (2020-2024)
2020-2024What Happened
Nigerian EFCC and international partners conducted repeated crackdowns on internet fraudsters called 'Yahoo Boys,' arresting hundreds annually. Meta banned 63,000 accounts in 2024. Despite 500+ EFCC cybercrime convictions and 751 police arrests in 2024, critics argue operations primarily catch low-level operators while masterminds persist.
Outcome
Short term: Hundreds of arrests and asset seizures; significant media coverage of enforcement.
Long term: BEC operations continue at scale; critics note masterminds remain untouched and networks quickly reconstitute.
Why It's Relevant
Illustrates the challenge INTERPOL faces: arresting hundreds doesn't guarantee dismantling sophisticated networks if operations only reach lower levels. Highlights need for sustained capacity building to reach organizers.