Skip to content
You can now search across every topic, entity and event.What's new
Cybersecurity: Threats and Defences
5SEP

Jackal IV produced 58 arrests in 23 countries

2 min read
12:09UTC

INTERPOL published results from Operation Jackal IV on 25 August: 58 arrests and 263 suspects identified across 23 countries. South Africa carried most of the enforcement.

TechnologyAssessed
Key takeaway

Two thirds of Jackal IV's arrests happened in South Africa, and the investigations remain open.

INTERPOL, the international police-cooperation body, published results from Operation Jackal IV on 25 August: 58 arrests, 263 suspects identified and 23 participating countries, from an operation that ran from November 2025 to June 2026 against West African organised crime groups 1. INTERPOL does not make arrests itself. It coordinates the national forces that do, which is the whole point of counting countries here.

South Africa carried most of the enforcement, raiding seven Johannesburg locations, arresting 39 people, seizing US$2.67 million and blocking 257 bank accounts tied to romance and investment schemes 2. One country therefore accounts for two thirds of the arrests in a 23-country operation, which says more about where the enforcement capacity sat than about where the fraud did.

The arrest count tells you the least about this operation and the country count the most. Freezing an account and arresting the person who opened it routinely sit in different jurisdictions, and each transfer of evidence between them runs on its own legal instrument. That is why an operation of this shape runs to eight months rather than eight weeks, and why the eventual number of arrests is a poor measure of what it cost.

Europe's police agency reached for the other lever in May, pulling 33 servers out of an anonymisation service that ransomware gangs relied on without announcing a single arrest . Property and people are separate problems with separate paperwork, and a fraud network sitting across two dozen countries makes you choose. Investigations remained open when INTERPOL published, so the 263 identified suspects are a working list rather than a result.

Deep Analysis

In plain English

INTERPOL coordinates police forces across countries. Operation Jackal IV targeted organised crime groups running romance scams (fake online relationships used to extract money) and fake investment schemes, mostly based in West Africa but operating worldwide online. Over eight months, 23 countries took part, arresting 58 people and identifying 263 suspects in total. South Africa did most of the enforcement work, arresting 39 people and seizing $2.67 million.

Deep Analysis
Root Causes

Romance and investment scam networks in West Africa often operate as loosely federated cells rather than a single hierarchy, which is why Operation Jackal IV needed 23 participating countries and eight months, November 2025 to June 2026, to reach 263 identified suspects across jurisdictions.

South Africa's share of the enforcement, 39 of the operation's 58 arrests and $2.67 million seized from seven Johannesburg raids, reflects Johannesburg's role as a regional hub for moving scam proceeds through the domestic banking system before further laundering.

First Reported In

Update #13 · Four privileged platforms under live attack

INTERPOL· 5 Sept 2026
Read original
Different Perspectives
ENISA
ENISA
ENISA published an SME cyber-resilience maturity model on 6 August and updated the Cyber Resilience Act reporting-platform FAQ on 31 August. The agency supplies common implementation tools for smaller operators, but it cannot fine organisations that do not use them.
UAE Cyber Security Council
UAE Cyber Security Council
On 10 August, the UAE Cyber Security Council said national teams contained attacks on aviation, energy and education before objectives were reached. Its second monthly statement, after a 3 July financial-sector disclosure, makes public reporting of stopped attacks part of its operating posture.
South African authorities
South African authorities
INTERPOL said on 25 August that South African authorities made 39 arrests, seized US$2.67 million and blocked 257 accounts during Operation Jackal IV. Their share of the 23-country operation shows the material enforcement burden in a cross-border fraud case.
Europol
Europol
On 2 September, Europol announced the sinkholing of Sality after a 31 August operation involving US, Bulgarian, Hungarian and Romanian authorities. Its more than 11 million linked IP addresses measure infrastructure contact, not confirmed victims, and show why technical partners joined the action.
CISA
CISA
From 3 August to 2 September, CISA recorded three-day deadlines for 24 of 37 KEV additions, compared with 34 of 39 from 10 June to 29 July. The falling share changes the urgency signal that US federal agencies and private-sector tooling draw from the catalogue.
Beacon
Beacon
On 3 September, Beacon said its final report found that an intruder likely exported its customer database during roughly one hour and 27 minutes on 27 July. Charities using the CRM now have a named exposure route, a compromised AWS access key in public build artefacts.