The Nigerian operation has been responsible for BEC campaigns across 150 countries affecting around 500,000 organizations.
Three gang members of a notorious group behind at least 500,000 business email compromise (BEC) campaigns across 150 have been arrested under an INTERPOL-led operation.
The gang hails from Nigeria, are were dubbed TMT by global cybersecurity firm Group-IB. The investigation continues as some of the gang members remain at large.
The three BEC gang members, all in their 30s, used these initials: ‘OC’, ‘IO’ and ‘OI’. The data discovered on the devices of the arrested TMT members has confirmed their involvement in the criminal scheme and were stolen from at least 50,000 targeted victims, according to Nigerian Police.
Group-IB has been tracking the gang since 2019 and established that around 500,000 government and private sector companies could have been compromised by TMT gang members. Based on the infrastructure that the attackers use and their techniques, Group-IB was also able to establish that the gang is divided into subgroups with a number of individuals still at large.
The findings on other suspected gang members, who Group-IB was able to track down, have been shared with INTERPOL’s Cybercrime Directorate for further action.
BEC modus operandi
Analysis of TMT operations revealed that the gang focuses on mass email phishing campaigns distributing popular malware strains under the guise of purchasing orders, product inquiries, and even COVID-19 aid, by impersonating legitimate companies.
The attackers use Gammadyne Mailer and Turbo-Mailer to send out phishing emails. MailChimp is used to track whether a recipient victim has opened the message. The gang was also seen using earlier compromised email accounts to push a new round of phishing attempts. The discovered email samples, detected and analyzed by Group-IB were crafted in English, Russian, Spanish, and other languages, depending on the scammers’ target list.
The goal of their attacks is to steal authentication data from browsers, email, and FTP clients. Over the course of their operations, the gang managed to infect organizations around the world, including in the US, the UK, Singapore, Japan, and even back home in Nigeria, according to Group-IB data.
While the monetization methods of this gang are still being investigated, it is not uncommon for cybercriminals to sell account access as well as sensitive data extracted form emails could to the highest bidder in the underground markets.
According to INTERPOL’s Cybercrime Director Craig Jones: “This group was running a well-established criminal business model. From infiltration to cashing in, they used a multitude of tools and techniques to generate maximum profits. We look forward to seeing additional results from this operation.”
Vesta Matveeva, head of a cyber investigations team, Group-IB APAC, noted: “This cross-border operation once again demonstrated that only effective collaboration between private sector cybersecurity companies and international law enforcement can bring evildoers to justice. It allows us to overcome regulatory differences across countries that impede threat intelligence data exchange.”
