Interpol Arrests 3 Nigerian BEC Scammers For Targeting Over 500,000 Entities

Three Nigerian citizens suspected of being members of an
organized cybercrime group behind distributing malware, carrying
out phishing campaigns, and extensive Business Email Compromise
(BEC) scams have been arrested in the city of Lagos, Interpol
reported yesterday.

The investigation, dubbed “Operation Falcon^[1],” was jointly undertaken
by the international police organization along with Singapore-based
cybersecurity firm Group-IB and the Nigeria Police Force, the
principal law enforcement agency in the country.

About 50,000 targeted victims of the criminal schemes have been
identified so far, as the probe continues to track down other
suspected gang members and the monetization methods employed by the
group.

Group-IB’s participation in the year-long operation came as part
of Interpol’s Project Gateway, which provides a framework for
agreements with selected private sector partners and receives
threat intel directly.

“The suspects are alleged to have developed phishing links,
domains, and mass mailing campaigns in which they impersonated
representatives of organizations,” Interpol said. “They then used
these campaigns to disseminate 26 malware programmes, spyware and
remote access tools, including AgentTesla, Loki, Azorult, Spartan
and the nanocore and Remcos Remote Access Trojans.”

In addition to perpetrating BEC campaigns and sending out emails
containing malware-laced email attachments, the attacks have been
used to infiltrate and monitor the systems of victim organizations
and individuals, leading to the compromise of at least 500,000
government and private sector companies in more than 150 countries
since 2017.

According to Group-IB^[2], the three individuals —
identified only by their initials OC, IO, and OI — are believed to
be members of a gang which it has been tracking under the moniker
TMT, a prolific cybercrime crew that it says is divided into
multiple smaller subgroups based on an analysis of the attackers’
infrastructure and techniques.

Some of their mass email phishing campaigns took the form of
purchasing orders, product inquiries, and even COVID-19 aid
impersonating legitimate companies, with the operators leveraging
Gammadyne Mailer and Turbo-Mailer to send out phishing emails. The
group also relied on MailChimp to track whether a recipient opened
the message.

The ultimate goal of the attacks, Group-IB noted, was to steal
authentication data from browsers, email, and FTP clients from
companies located in the US, the UK, Singapore, Japan, Nigeria,
among others.

“This group was running a well-established criminal business
model,” Interpol’s Cybercrime Director Craig Jones noted. “From
infiltration to cashing in, they used a multitude of tools and
techniques to generate maximum profits.”