Three Nigerians have been arrested for their alleged involvement
in a criminal organisation which is said to have compromised
thousands of government and private companies in more than 150
countries across the world.
The arrest was carried out by a joint operation of the
International Criminal Police Organisation (Interpol), Group-IB — a
cyber security company — and the Nigeria police force.
![image](/2020/11/NWLR-1.jpg")
INTERPOL, in a statement on Wednesday, noted that the arrest of
the suspects was as a result of a year-long investigation dubbed
“Operation Falcon”.
“The suspects are alleged to have developed phishing links,
domains, and mass mailing campaigns in which they impersonated
representatives of organizations. They then used these campaigns to
disseminate 26 malware programmes, spyware and remote access tools,
including AgentTesla, Loki, Azorult, Spartan and the nanocore and
Remcos Remote Access Trojans.” the statement reads.
“These programmes were used to infiltrate and monitor the
systems of victim organizations and individuals, before launching
scams and syphoning funds.
“According to Group-IB, the prolific gang is believed to have
compromised government and private sector companies in more than
150 countries since 2017.”
Speaking on the arrest, Craig Jones, Interpol’s cybercrime
director, was quoted as saying public-private relationships are
important in “disrupting virtual crimes”, as cooperation in
investigation will upset well-established criminal business
models.
“This group was running a well-established criminal business
model. From infiltration to cashing in, they used a multitude of
tools and techniques to generate maximum profits. We look forward
to seeing additional results from this operation,” Jones said.
In a separate statement on Wednesday, Group-IB described the
three arrested persons as follows: “«OC» (32 y.o.), «IO» (34 y.o.),
and «OI» (35 y.o.)”, adding that they were “identified with the
help of Group-IB Cyber Investigations and CERT-GIB teams”.
“The data discovered on the devices of the arrested TMT members
has confirmed their involvement in the criminal scheme and
identified stolen data from at least 50,000 targeted victims,
according to Nigerian Police,” the statement by Group-IB reads.
“Group-IB has been tracking the gang since 2019 and established
that around 500,000 government and private sector companies could
have been compromised by TMT gang members.
“Based on the infrastructure that the attackers use and their
techniques, Group-IB was also able to establish that the gang is
divided into subgroups with a number of individuals still at large.
The findings on other suspected gang members, whom Group-IB was
able to track down, have been shared with INTERPOL’s Cybercrime
Directorate. The investigation continues.
“The analysis of their operations revealed that the gang focuses
on mass email phishing campaigns distributing popular malware
strains under the guise of purchasing orders, product inquiries,
and even COVID-19 aid impersonating legitimate companies.”
Three Nigerians have been arrested for their alleged involvement
in a criminal organisation which is said to have compromised
thousands of government and private companies in more than 150
countries across the world.
The arrest was carried out by a joint operation of the
International Criminal Police Organisation (Interpol), Group-IB — a
cyber security company — and the Nigeria police force.
INTERPOL, in a statement on Wednesday, noted that the arrest of
the suspects was as a result of a year-long investigation dubbed
“Operation Falcon”.
“The suspects are alleged to have developed phishing links,
domains, and mass mailing campaigns in which they impersonated
representatives of organizations. They then used these campaigns to
disseminate 26 malware programmes, spyware and remote access tools,
including AgentTesla, Loki, Azorult, Spartan and the nanocore and
Remcos Remote Access Trojans.” the statement reads.
“These programmes were used to infiltrate and monitor the
systems of victim organizations and individuals, before launching
scams and syphoning funds.
“According to Group-IB, the prolific gang is believed to have
compromised government and private sector companies in more than
150 countries since 2017.”
Speaking on the arrest, Craig Jones, Interpol’s cybercrime
director, was quoted as saying public-private relationships are
important in “disrupting virtual crimes”, as cooperation in
investigation will upset well-established criminal business
models.
“This group was running a well-established criminal business
model. From infiltration to cashing in, they used a multitude of
tools and techniques to generate maximum profits. We look forward
to seeing additional results from this operation,” Jones said.
In a separate statement on Wednesday, Group-IB described the
three arrested persons as follows: “«OC» (32 y.o.), «IO» (34 y.o.),
and «OI» (35 y.o.)”, adding that they were “identified with the
help of Group-IB Cyber Investigations and CERT-GIB teams”.
“The data discovered on the devices of the arrested TMT members
has confirmed their involvement in the criminal scheme and
identified stolen data from at least 50,000 targeted victims,
according to Nigerian Police,” the statement by Group-IB reads.
“Group-IB has been tracking the gang since 2019 and established
that around 500,000 government and private sector companies could
have been compromised by TMT gang members.
“Based on the infrastructure that the attackers use and their
techniques, Group-IB was also able to establish that the gang is
divided into subgroups with a number of individuals still at large.
The findings on other suspected gang members, whom Group-IB was
able to track down, have been shared with INTERPOL’s Cybercrime
Directorate. The investigation continues.
“The analysis of their operations revealed that the gang focuses
on mass email phishing campaigns distributing popular malware
strains under the guise of purchasing orders, product inquiries,
and even COVID-19 aid impersonating legitimate companies.”