Interpol Nabs 3 Nigerian Scammers Behind Malware-based Attacks

Interpol on Monday announced the arrest of three suspected
global scammers in Nigeria for using remote access trojans (RATs)
such as Agent Tesla to facilitate malware-enabled cyber fraud.

“The men are thought to have used the RAT to reroute financial
transactions, stealing confidential online connection details from
corporate organizations, including oil and gas companies in South
East Asia, the Middle East and North Africa,” the International
Criminal Police Organization said^[1]
in a statement.

One of the scammers in question, named Hendrix Omorume, has been
charged and convicted of three counts of financial fraud and has
been sentenced to a 12-month prison term. The two other suspects
are still on trial.

The three Nigerian individuals, who are aged between 31 and 38,
have been apprehended for being in possession of fake documents
such as fraudulent invoices and forged official letters.

The law enforcement said that the suspects systematically used
Agent Tesla to breach business computers and divert financial
transactions to bank accounts under their control.

A .NET-based advanced malware that first appeared in 2014,
Agent Tesla^[2]
primarily gets delivered through phishing emails and has
capabilities such as keylogging, screen capture, form-grabbing,
credential stealing, and exfiltrating other sensitive
information.

The arrests follow a sting operation conducted simultaneously in
two different locations in the Nigerian cities of Lagos and Benin
City, with private sector intelligence provided by cybersecurity
company Trend Micro.

The operation is also part of a global law enforcement operation
codenamed “Killer Bee” involving Interpol and authorities from 11
different countries across Southeast Asia, including Brunei,
Cambodia, Indonesia, Laos, Malaysia, Myanmar, Philippines,
Singapore, Thailand, and Vietnam.

The development also comes close on the heels of the alleged
leader of the SilverTerrier BEC cybercrime gang in a separate
operation dubbed Delilah^[3]. It was preceded by two
related operations called Falcon I^[4]
and Falcon II^[5]
in 2020 and 2021.