Operation Delilah Leads to Arrest of Alleged Leader of TMT/SilverTerrier BEC Gang
Summary
A year-long international operation involving INTERPOL, Nigerian law enforcement and cybersecurity firms led to the arrest in Lagos of the alleged leader of the TMT/SilverTerrier phishing and BEC syndicate.
Key points
- Nigerian law enforcement arrested the 37-year-old suspect at Lagos’s Murtala Muhammed International Airport after investigators tracked his online and physical movements.
- Operation Delilah followed earlier INTERPOL-led operations Falcon I and Falcon II, which had resulted in arrests of other alleged syndicate members.
- Intelligence from Group-IB, Palo Alto Networks Unit 42 and Trend Micro helped INTERPOL and partner agencies coordinate the investigation.
- The syndicate used phishing and business email compromise schemes that affected businesses and individuals across multiple countries.
- Earlier investigation findings described the use of malware and remote access Trojans, including AgentTesla, Loky, AzoRult, Pony and NetWire, to steal authentication data.
- INTERPOL said a suspect arrested during Falcon II had more than 800,000 potential victim domain credentials on a laptop.
Article Details
- Event Type
- International law-enforcement operation that arrested the suspected leader of the TMT/SilverTerrier phishing and business email compromise syndicate.
- Impact
- The syndicate's phishing and BEC schemes affected companies and individuals across more than 150 countries. The article says TMT was believed to have compromised more than 500,000 companies by 2020; Operation Delilah culminated in the arrest of its suspected leader in Nigeria.
People
Threat Actors
Malware
AgentTeslaThe gang relied on publicly available spyware and remote access Trojans (RATs) like AgentTesla, Loky, AzoRult, Pony, and NetWire.AzoRultThe gang relied on publicly available spyware and remote access Trojans (RATs) like AgentTesla, Loky, AzoRult, Pony, and NetWire.LokyThe gang relied on publicly available spyware and remote access Trojans (RATs) like AgentTesla, Loky, AzoRult, Pony, and NetWire.NetWireThe gang relied on publicly available spyware and remote access Trojans (RATs) like AgentTesla, Loky, AzoRult, Pony, and NetWire.PonyThe gang relied on publicly available spyware and remote access Trojans (RATs) like AgentTesla, Loky, AzoRult, Pony, and NetWire.
Vendors
CyberTOOLBELTtracked the suspect’s online and physical movements with the assistance of private sector firm CyberTOOLBELT. Nigerian law enforcement arrested the 37-year-old suspect at Murtala Muhammed International AirportGroup-IBGroup-IB has been tracking TMT since 2017.Palo Alto NetworksOperation Delilah was launched based on intelligence from Group-IB, Palo Alto Networks Unit 42, and Trend Micro.Trend MicroOperation Delilah was launched based on intelligence from Group-IB, Palo Alto Networks Unit 42, and Trend Micro.
Countries
Australia(AFJOC) then shared this intelligence with Nigerian law enforcement and coordinated with agencies in Australia, Canada, and the United States through multiple case coordination meetings.Canadathen shared this intelligence with Nigerian law enforcement and coordinated with agencies in Australia, Canada, and the United States through multiple case coordination meetings.JapanTheir attacks affected organizations worldwide, including the US, UK, Singapore, Japan, and Nigeria.NigeriaAccording to INTERPOL, one suspect arrested during Falcon II in Nigeria was found with more than 800,000 potential victim domain credentials on his laptop.SingaporeTheir attacks affected organizations worldwide, including the US, UK, Singapore, Japan, and Nigeria.United KingdomUnited Stateswith Nigerian law enforcement and coordinated with agencies in Australia, Canada, and the United States through multiple case coordination meetings.