Team Cymru provided intelligence support for INTERPOL’s Operation Sentinel, a coordinated effort that resulted in 574 arrests, the recovery of approximately USD 3 million, and the disruption of multiple cybercrime networks across Africa.
Operation Sentinel ran from October 27 to November 27, focusing on business email compromise, digital extortion, and ransomware—categories identified as high-priority risks in INTERPOL’s 2025 Africa Cyber Threat Assessment Report. Through coordinated intelligence sharing and rapid operational collaboration, law enforcement partners aimed to disrupt attacks, prevent financial losses, and preserve critical services.
During the month-long operation, investigators removed more than 6,000 malicious links, decrypted six ransomware variants, and addressed cases tied to an estimated USD 21 million in attempted and realized losses.
Highlights from participating countries included Senegal, where authorities blocked a fraudulent USD 7.9 million transfer involving a petroleum company targeted through business email compromise. In Ghana, law enforcement developed a decryption tool to recover nearly 30 terabytes of data following a major ransomware attack and arrested multiple suspects.
A cross-border fraud network impersonating major fast-food brands was dismantled in Ghana and Nigeria, impacting over 200 victims. Benin authorities removed 43 malicious domains and shut down 4,318 social media accounts tied to extortion campaigns, leading to 106 arrests. In Cameroon, investigators traced a phishing operation to compromised infrastructure and initiated rapid freezes on associated bank accounts.
Neal Jetton, INTERPOL’s Director of Cybercrime, commented on the operation, stating that “The scale and sophistication of cyberattacks across Africa are accelerating, especially against critical sectors like finance and energy. The outcomes from Operation Sentinel reflect the commitment of African law enforcement agencies, working in close coordination with international partners. Their actions have successfully protected livelihoods, secured sensitive personal data and preserved critical infrastructure.”
Operation Sentinel brought together INTERPOL and several private-sector partners, including Team Cymru, The Shadowserver Foundation, Trend Micro, TRM Labs, and Uppsala Security. Team Cymru contributed intelligence support, which assisted in tracking malicious infrastructure, mapping criminal behavior, and accelerating investigations across jurisdictions.
Jacomo Piccolini, Manager of Outreach at Team Cymru, highlighted the importance of collaboration, stating that “Operations like Sentinel show the power of trusted collaboration. Cybercrime is global, but so is the community working to stop it. We’re proud to help deliver the visibility needed to protect economies, institutions, and citizens.”
Operation Sentinel was coordinated under the African Joint Operation against Cybercrime (AFJOC) and supported through the Global Action on Cybercrime Enhanced project (GLACY-e). Participating nations included Benin, Botswana, Burkina Faso, Cameroon, Chad, Congo, Djibouti, Democratic Republic of the Congo, Gabon, Ghana, Kenya, Malawi, Nigeria, Senegal, South Africa, South Sudan, Uganda, Zambia, and Zimbabwe.
Team Cymru functions as an intelligence partner, providing global visibility to help protect nations, businesses, and communities. Powered by Pure Signal™, the company focuses on transforming telemetry into actionable insights, aiming to reduce noise, accelerate decision-making, and drive real-world outcomes across areas such as threat hunting, CTI, third-party risk, and national defense. Through its Community Services, Team Cymru also offers no-cost threat detection, DDoS mitigation, and intelligence to over 177 CSIRTs across more than 85 countries.
