INTERPOL Operations Lead to 14 Arrests in BEC Network Investigation
Summary
Two INTERPOL-led operations in Nigeria resulted in 14 arrests linked to a BEC network, including suspected TMT gang members. Investigators tied the group to phishing, credential theft and fraud affecting tens of thousands of potential victims.
Key points
- Operation Falcon I led to the arrest of three TMT members in Lagos in November 2020.
- Falcon II resulted in eleven arrests during a ten-day operation in December 2021; the article says the TMT leader was arrested in May 2022 in Operation Delilah.
- The group used phishing emails, compromised mailboxes and malware such as AgentTesla, Lokibot, AzoRult, Pony and NetWire to steal credentials.
- Investigators found evidence associating the suspects with more than 50,000 targets; one suspect had over 800,000 potential victim domain credentials stored on a laptop.
- After Falcon I, remaining members reportedly updated phishing kits to route stolen data through Telegram bots and attempted to target Group-IB employees.
- Group-IB shared threat intelligence and forensic findings with INTERPOL and Nigerian law enforcement to support arrests and help prevent further fraud.
Article Details
- Event Type
- Cross-border law-enforcement operations against a cybercrime network conducting business email compromise (BEC) attacks.
- Impact
- Falcon I resulted in three arrests in Lagos in November 2020. Falcon II resulted in eleven alleged cybercrime-network members being arrested in December 2021. The article reports that the final TMT gang leader was arrested in May 2022 during Operation Delilah. Data examined during the operations indicated involvement in schemes associated with more than 50,000 targets; one suspect had more than 800,000 potential victim domain credentials stored on a laptop. The operations also supported sharing intelligence to help prevent further fraud.
People
Threat Actors
SilverTerrierCybercrime gang identified in the article as the recipient of funds diverted by one suspect; INTERPOL coordinated further action against its bank accounts.TMT gangGroup-IB’s codename for the cybercriminal group responsible for BEC and phishing campaigns; the name was derived from a username used by one of its leaders.
Malware
404 Keylogger404 KeyloggerAdwindAdwindAgentTeslaThe group relied exclusively on a variety of publicly available spyware and Remote Access Trojans (RATs), including AgentTesla, Lokibot, AzoRult, Pony, and NetWire.ASPIRE CRYPTASPIRE CRYPTAtilla CrypterAtilla CrypterAveMariaAveMariaAzoRultThe group relied exclusively on a variety of publicly available spyware and Remote Access Trojans (RATs), including AgentTesla, Lokibot, AzoRult, Pony, and NetWire.Cassandra CrypterCassandra CrypterCloudEyE ProtectorCloudEyE ProtectorConfuserExConfuserExCyanx SharpCyanx SharpCypherITCypherITDarkEyE ProtectorDarkEyE ProtectorHawkEyeHawkEyeHWorm (Houdini)HWorm (Houdini)LokiLokiLokiBotThe group relied exclusively on a variety of publicly available spyware and Remote Access Trojans (RATs), including AgentTesla, Lokibot, AzoRult, Pony, and NetWire.NanoCoreNanoCoreNetWireThe group relied exclusively on a variety of publicly available spyware and Remote Access Trojans (RATs), including AgentTesla, Lokibot, AzoRult, Pony, and NetWire.Origin KeyloggerOrigin KeyloggerPhoenix KeyloggerPhoenix KeyloggerPonyThe group relied exclusively on a variety of publicly available spyware and Remote Access Trojans (RATs), including AgentTesla, Lokibot, AzoRult, Pony, and NetWire.RemcosRemcosSpartan CrypterSpartan CrypterThe Old Phantom CrypterThe Old Phantom CrypterToretto Exploit SoftwareToretto Exploit SoftwareViottoKeyloggerViottoKeyloggerWarzone RATWarzone RAT
Vendors
Products
Tools
Gammadyne MailerBy analyzing email headers, we discovered that the group relied on email automation tools like Gammadyne Mailer and Turbo-Mailer to distribute their phishing emails.Turbo-MailerBy analyzing email headers, we discovered that the group relied on email automation tools like Gammadyne Mailer and Turbo-Mailer to distribute their phishing emails.
Countries
GambiaAnother individual was suspected to have taken part in BEC crime across a wide range of West African countries including Gambia, Ghana, and Nigeria.GhanaAnother individual was suspected to have taken part in BEC crime across a wide range of West African countries including Gambia, Ghana, and Nigeria.JapanThroughout their operations, the gang members managed to infect organizations around the world, including in the US, the UK, Singapore, Japan, and even back home in Nigeria, according to Group-IB data.NigeriaOriginally from Nigeria, the TMT gang’s activities spanned a vast scale, compromising approximately 500,000 government entities and private companies across more than 150 countries.SingaporeThroughout their operations, the gang members managed to infect organizations around the world, including in the US, the UK, Singapore, Japan, and even back home in Nigeria, according to Group-IB data.United KingdomThroughout their operations, the gang members managed to infect organizations around the world, including in the US, the UK, Singapore, Japan, and even back home in Nigeria, according to Group-IB data.United StatesThis led us to suspect that a group of Nigerian fraudsters might be behind the attacks.