Results announced by INTERPOL and reported by Security Affairs attribute 1,462 arrests, the disruption of 10,909 malicious networks and the recovery of more than $105 million in illicit funds to Operation Serengeti III. The operation spanned 21 countries.
The reported figures describe a single synchronised action bringing together law enforcement agencies from the 21 participating countries, rather than a series of disconnected national cases. The malicious networks taken out of action are the shared services scam groups depend on — phishing domains, command-and-control nodes, fraudulent online storefronts and money-mule accounts — rather than the suspects themselves.
Scam operations are commonly structured so that recruiters sit in one country, call-centre style operators in another, and money mules and cash-out points elsewhere. With no single national police force holding a complete picture, INTERPOL has served as the coordination hub for the Serengeti campaigns, interrupting the chain across borders rather than in one jurisdiction at a time.
The typologies involved — investment and trading scams, romance fraud, business email compromise, phishing campaigns and the recruitment of money mules through fake job advertisements — are ones readers in Hong Kong will recognise. None of them require sophisticated technical capability to run, which is why they scale so effectively and why disruption at the infrastructure level reaches further than arrests alone.
INTERPOL also runs regionally focused operations such as the HAECHI series, which targets fraud and money laundering with an Asia-Pacific lens. Where HAECHI concentrates on a single theatre, Serengeti's footprint spans a wider geography, reflecting the borderless structure of modern scam ecosystems.
Security researchers describe a crime-as-a-service industrialisation behind the climbing totals, in which phishing kits, mule networks, laundered credential pools and cash-out infrastructure are sold or rented as discrete products. In that model, arresting one operator accomplishes little: the toolkit survives, a replacement picks it up, and the same infrastructure serves the next group. Coordinated, multi-jurisdiction action against shared nodes is the intervention that most reliably breaks the cycle — though gains remain temporary until the underlying services are rebuilt.
Because takedowns of phishing domains and command-and-control nodes rarely persist, this operation points to infrastructure rather than individual arrests as the pressure point in modern scam ecosystems — one that can only be reached through collective, cross-border action.
Source: Security Affairs
國際刑警組織（INTERPOL）公布的成果、並經Security Affairs報道，將拘捕1,462人、搗毀10,909個惡意網絡基礎設施，以及追回超過1.05億美元非法資金的戰果，歸於塞倫蓋蒂三號行動（Operation Serengeti III）。該行動橫跨21個國家。
報道所載數字描述的是一次同步行動，將21個參與國的執法部門整合起來，而非一系列各自為政的單一國家案件。被搗毀的惡意網絡基礎設施，是詐騙集團所依賴的共享服務——包括釣魚網域名稱（phishing domains）、command-and-control節點、虛假網上商店以及錢騾賬戶（money mule accounts）——而非嫌疑人本身。
詐騙集團的運作模式通常將招募人員置於一國、call centre式操作員置於另一國，而錢騾和套現點則分佈於其他地方。由於沒有任何單一國家的警隊能掌握完整圖景，INTERPOL一直擔當塞倫蓋蒂系列行動的協調中樞，中斷跨國鏈條，而非逐個司法管轄區處理。
涉及的詐騙類型——投資及交易騙案、交友詐騙（romance fraud）、商業電郵詐騙（business email compromise）、釣魚攻擊（phishing campaigns），以及透過虛假招聘廣告招募錢騾——都是香港讀者會熟悉的類別。這些手法運作時都不需要高深的技術能力，正因如此才能如此有效地擴張，也正因如此，在基礎設施層面採取行動，成效比單純拘捕個別嫌疑人更為深遠。
INTERPOL亦有開展區域性行動，例如以亞太地區為視角、針對詐騙及洗錢的HAECHI系列。HAECHI集中於單一區域戰場，而塞倫蓋蒂的足跡涵蓋更廣泛的地理範圍，反映出當代詐騙生態系統無國界的結構。
安全研究人員指出，持續攀升的數字背後是「crime-as-a-service」的工業化——釣魚工具包（phishing kits）、錢騾網絡、洗白的憑證池（credential pools）及套現基礎設施，均作為獨立產品出售或租賃。在這種模式下，逮捕一名操作員成效有限：工具包依然存在，有人會接手使用，同一套基礎設施會繼續服務下一個集團。針對共享節點、跨司法管轄區的協同行動，是最能可靠打破循環的介入手段——不過在底層服務被重建之前，成果仍然只是暫時的。
由於釣魚網域名稱及command-and-control節點的取締（takedown）極少能持久生效，是次行動指出，在當代詐騙生態系統中，壓力點在於基礎設施而非個別拘捕——而要接觸到這一壓力點，只能透過跨國集體行動。
資料來源：Security Affairs