Hundreds of Arrests as Operation Sentinel Recovers $3m
African law enforcers have arrested 574 suspects in a new operation targeting cybercriminals across the continent, according to Interpol.
Operation Sentinel ran from October 27 to November 27 and focused on three of the most common cybercrime categories: business email compromise (BEC), digital extortion and ransomware.
The Interpol-coordinated operation led to the recovery of $3m in alleged cybercrime proceeds and the takedown of 6000 malicious links, as well as the decryption of six ransomware variants.
Interpol claimed the cases investigated during the operation were linked to financial losses exceeding $21m.
Among the successes of the month-long campaign were:
Cybercrime now accounts for 30% of all reported crime in Western and Eastern Africa and is increasing rapidly elsewhere on the continent, Interpol warned in June .
Its 2025 Africa Cyberthreat Assessment Report noted that two-thirds of African member countries claim cyber-related offenses now account for a “medium-to-high” (i.e., 10-30% or 30%+) of all crimes.
“The scale and sophistication of cyber-attacks across Africa are accelerating, especially against critical sectors like finance and energy,” warned Interpol director of cybercrime, Neal Jetton.
“The outcomes from Operation Sentinel reflect the commitment of African law enforcement agencies, working in close coordination with international partners. Their actions have successfully protected livelihoods, secured sensitive personal data and preserved critical infrastructure.”
Team Cymru, The Shadowserver Foundation, Trend Micro, TRM Labs and Uppsala Security took part in Operation Sentinel. It was run by the African Joint Operation against Cybercrime (AFJOC), funded by the UK and EU.
The following African countries participated: Benin, Botswana, Burkina Faso, Cameroon, Chad, Congo, Djibouti, Democratic Republic of the Congo, Gabon, Ghana, Kenya, Malawi, Nigeria, Senegal, South Africa, South Sudan, Uganda, Zambia and Zimbabwe.
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
