If you’ve ever thought cybercrime operates without real consequences, INTERPOL’s latest actions prove the opposite. In one of the largest international operations in recent years, the global police organization coordinated the arrest of 574 individuals across Africa, recovered more than $3 million, and dismantled hundreds of criminal digital infrastructures.
At TecnetOne, we analyze this case because it marks a turning point in the fight against ransomware, digital extortion, and Business Email Compromise (BEC)—threats that directly affect companies in Latin America, Europe, and the United States.
The offensive, known as Operation Sentinel, took place between October 27 and November 27, 2025. During that month, law enforcement agencies from 19 African countries worked together to disrupt criminal networks that had operated with relative impunity for years.
Participating countries included:
The operation focused on three major threats you’re likely already familiar with:
The figures reveal both the scale of the problem and the impact of the crackdown:
Although INTERPOL did not disclose the specific ransomware families decrypted, this detail is critical: breaking ransomware encryption directly reduces attackers’ extortion power and helps future victims recover.
Learn more: Ransomware Hunters International Shuts Down Operations
Behind the numbers are concrete cases that reveal how these criminal networks operate.
Ransomware Attack on a Financial Institution in Ghana
One of the most serious incidents investigated was a ransomware attack against a financial institution in Ghana. The attackers:
Multiple individuals were arrested in connection with the attack, proving that even well-protected banks remain high-value targets.
Another revealing case involved a criminal network operating between Ghana and Nigeria. This group:
The impact was severe: over 200 victims and losses exceeding $400,000. As part of the operation:
In Benin, authorities dismantled an even broader infrastructure:
These accounts were used for extortion, scams, and social engineering campaigns—proof that cybercrime doesn’t live only on the dark web, but also on platforms people use every day.
Neal Jetton, INTERPOL’s Director of Cybercrime, was explicit:
“The scale and sophistication of cyberattacks in Africa are accelerating, particularly against critical sectors such as finance and energy.”
This warning isn’t limited to Africa. At TecnetOne, we see it daily: attacks are becoming more professional, more coordinated, and more global.
Operation Sentinel is part of the African Joint Operation against Cybercrime (AFJOC) initiative. Its goals go beyond arrests:
This collaborative approach is essential, because cybercrime ignores borders.
While INTERPOL acted in Africa, another major development unfolded in the United States.
A 35-year-old Ukrainian national, Artem Aleksandrovych Stryzhak, pleaded guilty to participating as an affiliate of the Nefilim ransomware operation. He was arrested in Spain in June 2024 and extradited to the U.S. in April 2025.
If you run a business, this part matters.
Nefilim followed the double extortion model:
Stryzhak received access to the ransomware code in exchange for 20% of the ransom payments. Before launching attacks, he researched companies using public databases to assess:
Targets were companies with annual revenues over $200 million in the United States, Canada, and Australia.
Similar titles: BidenCash Market Domains Seized in International Operation
Stryzhak pleaded guilty to conspiracy to commit computer fraud. His sentencing is scheduled for May 6, 2026, and he faces up to 10 years in prison.
Meanwhile, another Ukrainian national, Volodymyr Tymoshchuk, alleged administrator of Nefilim and LockerGoga, remains a fugitive. Authorities are offering a $11 million reward for information leading to his capture.
From TecnetOne’s perspective, this case leaves several clear takeaways:
The 574 arrests, millions recovered, and convictions of ransomware operators send a strong message: cybercrime is no longer a safe haven for attackers.
Still, you can’t rely solely on law enforcement. The key question remains: is your organization prepared to withstand an attack before it happens?
At TecnetOne, we believe modern cybersecurity isn’t just about reacting—it’s about anticipating, detecting, and resisting. Because even when criminals fall, others will always try to take their place.