Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Attacks/Breaches

11/30/2020
01:45 PM
Dark Reading
Dark Reading
Products and Releases
50%
50%

Operation Falcon: INTERPOL and Group-IB Identify Nigerian BEC Ring Members

Singapore, 25/11/2020 — Group-IB, a global threat hunting and intelligence company, supported an INTERPOL-led operation Falcon targeting business email compromise (BEC) cybercrime gang from Nigeria, dubbed TMT by Group-IB. A cross-border anti-cybercrime effort that involved INTERPOL’s Cybercrime Directorate, Nigerian Police Force, and Group-IB’s APAC Cyber Investigations Team has resulted in the arrest of three individuals in Lagos. Since at least 2017, the prolific gang compromised at least 500,000 government and private sector companies in more than 150 countries. The investigation continues as some of the gang members remain at large. 

Business Email Compromise (BEC) is a type of email phishing attack that relies on social engineering. As part of BEC, phishing emails can target particular people within an organization or sent out en masse. Often disguised as money transfer requests, HR-communications or business proposals they aim to steal confidential data. 

The three BEC gang members with the initials “OC” (32 y.o.), “IO” (34 y.o.), and “OI” (35 y.o.), identified with the help of Group-IB Cyber Investigations and CERT-GIB teams, have been arrested in Lagos not long ago by Nigerian cybercrime police unit as part of the Falcon operation. The data discovered on the devices of the arrested TMT members has confirmed their involvement in the criminal scheme and identified stolen data from at least 50,000 targeted victims, according to Nigerian Police.

Group-IB has been tracking the gang since 2019 and established that around 500,000 government and private sector companies could have been compromised by TMT gang members. Based on the infrastructure that the attackers use and their techniques, Group-IB was also able to establish that the gang is divided into subgroups with a number of individuals still at large. The findings on other suspected gang members, whom Group-IB was able to track down, have been shared with INTERPOL's Cybercrime Directorate. The investigation continues. 

The analysis of their operations revealed that the gang focuses on mass email phishing campaigns distributing popular malware strains under the guise of purchasing orders, product inquiries, and even COVID-19 aid impersonating legitimate companies. 

The attackers use Gammadyne Mailer and Turbo-Mailer to send out phishing emails. MailChimp is used to track whether a recipient victim has opened the message.

The gang was also seen using earlier compromised email account to push a new round of phishing attempts. The discovered email samples, detected and analyzed by Group-IB Threat Hunting Framework, were crafted in English, Russian, Spanish, and other languages depending on the scammers’ target list.

Group-IB researchers note that the cybercriminals behind these BEC operations rely exclusively on a variety of publicly available Spyware and Remote Access Trojans (RATs), such as AgentTesla, Loky, AzoRult, Pony, NetWire, etc. To avoid detection and tracking by traditional security tools the gang uses public crypters. Most often malware operated by TMT communicates with the attackers’ C&C server using SMTP, FTP, HTTP protocols. 

The goal of their attacks is to steal authentication data from browsers, email, and FTP clients. Over the course of their operations, the gang managed to infect organizations around the world, including in the US, the UK, Singapore, Japan, and even back home in Nigeria, according to Group-IB data. While the monetization methods of this gang are still being investigated, it’s not uncommon for cybercriminals to sell account access as well as sensitive data extracted form emails could to the highest bidder in the underground markets.

Craig Jones, INTERPOL’s Cybercrime Director highlighted the outstanding cooperation between all those involved in the investigation and underlined the importance of public-private relationships in disrupting virtual crimes. “This group was running a well-established criminal business model. From infiltration to cashing in, they used a multitude of tools and techniques to generate maximum profits. We look forward to seeing additional results from this operation,” he said.

“This cross-border operation once again demonstrated that only effective collaboration between private sector cybersecurity companies and international law enforcement can bring evildoers to justice,” comments Vesta Matveeva, head of cyber investigations team at Group-IB APAC. “It allows to overcome regulatory differences across countries that impede threat intelligence data exchange. While further investigation is underway, we are proud of what we’ve been able to achieve thanks to coordinated efforts by INTERPOL with the support of Nigerian cyber police.”

About Group-IB

Group-IB is a Singapore-based provider of solutions aimed at detection and prevention of cyberattacks and online fraud. The company also specializes in high-profile cyber investigations and IP protection services. Group-IB’s Threat Intelligence & Attribution system has been named one of the best in class by Gartner, Forrester, and IDC, while its Threat Hunting Framework has been recognized as one of the leaders in Network Detection and Response by the leading European analyst agency KuppingerCole Analysts AG. 

Gartner identified Group-IB as a Representative Vendor in Online Fraud Detection for the company’s Fraud Hunting Platform. In addition, Group-IB was recognized as a Representative Vendor in Gartner’s Market Guide for Digital Forensics and Incident Response Services.

Group-IB’s technological leadership is built on the company’s 17 years of hands-on experience in cybercrime investigations around the world and 65 000 hours of cyber security incident response accumulated in one of the biggest forensic laboratories and a round-the-clock center providing a rapid response to cyber incidents—CERT-GIB. 

Group-IB is a partner of INTERPOL and Europol, and has been recommended by the OSCE as a cybersecurity solutions provider.

Our mission is to protect clients in cyberspace using innovative products and services.

For more information, please contact:

[email protected]

+65 3159-3798

https://www.group-ib.com

https://www.group-ib.com/blog

Twitter | LinkedIn |Facebook

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
News
Inside the Ransomware Campaigns Targeting Exchange Servers
Kelly Sheridan, Staff Editor, Dark Reading,  4/2/2021
Commentary
Beyond MITRE ATT&CK: The Case for a New Cyber Kill Chain
Rik Turner, Principal Analyst, Infrastructure Solutions, Omdia,  3/30/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-24285
PUBLISHED: 2021-04-12
INTELBRAS TELEFONE IP TIP200 version 60.61.75.22 allows an attacker to obtain sensitive information through /cgi-bin/cgiServer.exx.
CVE-2021-29379
PUBLISHED: 2021-04-12
** UNSUPPORTED WHEN ASSIGNED ** An issue was discovered on D-Link DIR-802 A1 devices through 1.00b05. Universal Plug and Play (UPnP) is enabled by default on port 1900. An attacker can perform command injection by injecting a payload into the Search Target (ST) field of the SSDP M-SEARCH discover pa...
CVE-2015-20001
PUBLISHED: 2021-04-11
In the standard library in Rust before 1.2.0, BinaryHeap is not panic-safe. The binary heap is left in an inconsistent state when the comparison of generic elements inside sift_up or sift_down_range panics. This bug leads to a drop of zeroed memory as an arbitrary type, which can result in a memory ...
CVE-2020-36317
PUBLISHED: 2021-04-11
In the standard library in Rust before 1.49.0, String::retain() function has a panic safety problem. It allows creation of a non-UTF-8 Rust string when the provided closure panics. This bug could result in a memory safety violation when other string APIs assume that UTF-8 encoding is used on the sam...
CVE-2020-36318
PUBLISHED: 2021-04-11
In the standard library in Rust before 1.49.0, VecDeque::make_contiguous has a bug that pops the same element more than once under certain condition. This bug could result in a use-after-free or double free.