SilverTerrier
{{Short description|Nigerian based cyber crime syndicate}}
{{Orphan|date=January 2022}}
SilverTerrier is a code name for a syndicate of BEC cyber criminals. Identified by the Interpol's Global Financial Crime Taskforce to be from Nigeria, they are a syndicate of over 400 unique actors or groups accused of targeting thousands of organizations worldwide through business email compromise (BEC) scams.{{Cite web|last=Brewster|first=Thomas|title=800,000 Passwords, 50,000 Targets: A Huge Nigerian Fraud Operation Busted|url=https://www.forbes.com/sites/thomasbrewster/2022/01/19/800000-passwords-50000-targets-a-huge-nigerian-fraud-operation-busted/|access-date=2022-01-21|website=Forbes|language=en}}{{Cite web|title=Nigerian cybercrime fraud: 11 suspects arrested, syndicate busted|url=https://www.interpol.int/en/News-and-Events/News/2022/Nigerian-cybercrime-fraud-11-suspects-arrested-syndicate-busted|access-date=2022-01-21|website=www.interpol.int|language=en}}
Starting as far back as 2014 as novices, the cyber crime gang has used tens of thousands of financial scams dating back using several malware tools.{{Cite web|title=MVISION Insights: SilverTerrier Covid-19 BEC Scheme|url=https://kc.mcafee.com/corporate/index?page=content&id=KB93392&locale=en_US|access-date=2022-01-21|website=kc.mcafee.com}}
Background
In 2014, security researchers at Palo Alto Networks' Unit42 threat-intelligence coined the name SilverTerrier to describe novice Nigerian malware groups using business email compromise attacks to exploit organizations across several sectors and countries.{{Cite web|title=Nigerian BEC Scammers Shifting to RATs As Tool of Choice|url=https://www.bleepingcomputer.com/news/security/nigerian-bec-scammers-shifting-to-rats-as-tool-of-choice/|access-date=2022-01-21|website=BleepingComputer|language=en-us}} By 2019, 81,300 malware samples by Nigeria's BEC groups were attributed to over 2,100,00 attacks.{{Cite web|title=Nigerian cybercriminals join big league|url=https://ia.acs.org.au/article/2020/nigerian-cybercriminals-join-big-league.html|access-date=2022-01-21|website=Information Age}} In 2019, the group was linked to over 400 threat actors, compared to 300 in 2018.{{Cite web|title=Nigerian BEC Scammers Growing Smarter, More Dangerous|url=https://threatpost.com/nigerian-bec-scammers-growing-smarter-more-dangerous/131854/|access-date=2022-01-21|website=threatpost.com|date=10 May 2018 |language=en}} They were observed to have gone from launching 28,000 BEC attacks per month in 2018{{Cite web|date=May 13, 2019|first=Scott|last=Ferguson|title=Nigerian BEC Scammers Use Malware to Up the Ante|url=https://www.bankinfosecurity.com/nigerian-bec-scammers-use-malware-to-up-ante-a-12475|access-date=2022-01-21|website=www.bankinfosecurity.com|language=en}} to 245,637 in 2019 towards organizations across many sectors.{{Cite web|title=Nigerian Authorities Arrest 11 Members of Prolific BEC Fraud Group|url=https://www.securityweek.com/nigerian-authorities-arrest-11-members-prolific-bec-fraud-group|access-date=2022-01-21|website=www.securityweek.com|date=21 January 2022 }}
They've been responsible for attacks on 50,000 different individuals and companies since inception.
They have been linked to several COVID-19 themed attacks consisting of fake orders for personal protective equipment, shipping delay notices for COVID-19-related items, fake vaccine-related news which come attached with malware.{{Cite web|first=Brandon|last=Vigliarolo|date=May 7, 2020|title=Businesses: Beware of COVID-19 email compromise scams|url=https://www.techrepublic.com/article/businesses-beware-of-covid-19-email-compromise-scams/|access-date=2022-01-21|website=TechRepublic|language=en}}
Law Enforcement Activity
Due to the high profile of SilverTerrier, they garnered the attention of a wide range of Law Enforcement agencies. This eventually led to arrests of 11 individuals being made between December 13, 2021, and December 22, 2021, during an operation by the Nigerian Police Force and INTERPOL.{{Cite web|title=Interpol nabs 11 Nigerian cyber scam kingpins, one with 800K web credentials - P.M. News|url=https://pmnewsnigeria.com/2022/01/20/interpol-nabs-11-nigerian-cyber-scam-kingpins-one-with-800k-web-credentials/|access-date=2022-01-21|language=en-US}}
The arrests were a combined effort by Interpol's Cybercrime Directorate in Singapore, Nigerian law enforcement agencies, Group-IB and Palo Alto Networks.{{Cite web|title=Interpol Busted 11 Members of Nigerian BEC Cybercrime Gang|url=https://thehackernews.com/2022/01/interpol-busted-11-members-of-nigerian.html|access-date=2022-01-21|website=The Hacker News|language=en}}
The suspects were based in Lagos and Asaba, and were regarded as being part of the technical backbone of the operations, rather than low-level money mules.
According to a statement by the Assistant General of Police, Garba Baba Umar who doubles as the INTERPOL's vice president for Africa, "One of the arrested suspects was in possession of more than 800,000 user names and passwords. Another suspect had been monitoring conversations between 16 companies and their clients and diverting funds to ‘SilverTerrier’ whenever company transactions were about to be made".{{Cite web|last=Uchechukwu|first=Oghenekevwe|date=2022-01-19|title=NPF, Interpol bust cybercrime syndicate targeting over 50,000 victims|url=https://www.icirnigeria.org/npf-interpol-bust-cybercrime-syndicate-targeting-over-50000-victims/|access-date=2022-01-21|website=International Centre for Investigative Reporting|language=en-GB}}
In May 2022, Interpol announced the arrest 37-year-old Nigerian man in an international operation spanning four continents. The individual was regarded as the leader of the cybercrime syndicate. The police operation, codenamed Delilah, was initiated by an intelligence referral from several INTERPOL partners from the private sector: Group-IB, Palo Alto Networks Unit 42 and Trend Micro.{{Cite web|title=Suspected head of cybercrime gang arrested in Nigeria|url=https://www.interpol.int/News-and-Events/News/2022/Suspected-head-of-cybercrime-gang-arrested-in-Nigeria|access-date=2022-08-25|website=interpol.int|language=en}}
References
{{Reflist}}