Skip to content
Welcome, thoughtbot's Giant Robots listeners!Start here
Cybersecurity: Threats and Defences
5SEP

Jackal IV produced 58 arrests in 23 countries

2 min read
12:09UTC

INTERPOL published results from Operation Jackal IV on 25 August: 58 arrests and 263 suspects identified across 23 countries. South Africa carried most of the enforcement.

TechnologyAssessed
Key takeaway

Two thirds of Jackal IV's arrests happened in South Africa, and the investigations remain open.

INTERPOL, the international police-cooperation body, published results from Operation Jackal IV on 25 August: 58 arrests, 263 suspects identified and 23 participating countries, from an operation that ran from November 2025 to June 2026 against West African organised crime groups⁠1. INTERPOL does not make arrests itself. It coordinates the national forces that do, which is the whole point of counting countries here.

South Africa carried most of the enforcement, raiding seven Johannesburg locations, arresting 39 people, seizing US$2.67 million and blocking 257 bank accounts tied to romance and investment schemes⁠2. One country therefore accounts for two thirds of the arrests in a 23-country operation, which says more about where the enforcement capacity sat than about where the fraud did.

The arrest count tells you the least about this operation and the country count the most. Freezing an account and arresting the person who opened it routinely sit in different jurisdictions, and each transfer of evidence between them runs on its own legal instrument. That is why an operation of this shape runs to eight months rather than eight weeks, and why the eventual number of arrests is a poor measure of what it cost.

Europol-backed police reached for the other lever in May, pulling 33 servers out of an anonymisation service that ransomware gangs relied on and interviewing its administrator in Ukraine. Property and people are separate problems with separate paperwork, and a fraud network sitting across two dozen countries makes you choose. Investigations remained open when INTERPOL published, so the 263 identified suspects are a working list rather than a result.

Deep Analysis

In plain English

INTERPOL coordinates police forces across countries. Operation Jackal IV targeted organised crime groups running romance scams (fake online relationships used to extract money) and fake investment schemes, mostly based in West Africa but operating worldwide online. Over eight months, 23 countries took part, arresting 58 people and identifying 263 suspects in total. South Africa did most of the enforcement work, arresting 39 people and seizing $2.67 million.

Deep Analysis
Root Causes

Romance and investment scam networks in West Africa often operate as loosely federated cells rather than a single hierarchy, which is why Operation Jackal IV needed 23 participating countries and eight months, November 2025 to June 2026, to reach 263 identified suspects across jurisdictions.

South Africa's share of the enforcement, 39 of the operation's 58 arrests and $2.67 million seized from seven Johannesburg raids, reflects Johannesburg's role as a regional hub for moving scam proceeds through the domestic banking system before further laundering.

First Reported In

Update #13 · Four privileged platforms under live attack

INTERPOL· 5 Sept 2026
Read original →
Different Perspectives
Hospital Sírio-Libanês
Hospital Sírio-Libanês
Hospital Sírio-Libanês said a 21 September attack reached a reporting system for its social projects, possibly exposing patients' and staff identity numbers and health information, while its general patient database was untouched. It notified the ANPD and the Polícia Federal and warned of fraud attempts.
The Foschini Group
The Foschini Group
The Foschini Group told the Johannesburg exchange on 13 October that an attack found on 11 October disrupted IT systems at its TFG London brands, while stores stayed open. It has not identified the attackers or established whether personal data was taken.
FirstVDS
FirstVDS
FirstVDS said attackers used a VMmanager 6 flaw to copy customers' passwords, cloud credentials and cryptocurrency wallets from beneath their virtual servers, and told notified customers to assume theft and rotate credentials. ISPsystem's flaw was not fully fixed on 19 October.
ESET
ESET
ESET says Russia-aligned UAC-0099 phished a Ukrainian grain logistics firm in July 2025 and apparently passed its access to GRU-linked Sandworm, which wiped the company's data that September. It treats the attackers' use of the Yggdrasil network as a first for a state-aligned actor.
JPCERT/CC
JPCERT/CC
JPCERT/CC issued emergency alert AT-2026-0032 on 14 October as EG Secure Solutions confirmed attacks on the SiteGuard Server Edition flaw. It told operators to save diagnostic data before updating, because the update may erase traces of the attack.
Cyber Security Agency of Singapore
Cyber Security Agency of Singapore
The Cyber Security Agency of Singapore said on 20 October that attackers are exploiting Ivanti Connect Secure, seven days after Ivanti's disclosure, having flagged PAN-OS exploitation on 16 October. It issued a PHP2Shell alert on 21 October, the day the fixes shipped.

Written with AI from Lowdown's published reporting. Not individually reviewed by an editor. Editorial standards.