Country

Nigeria

0 mentions in 7 days · 6 in 30 days · 8 total · first seen Aug 11, 2026 · last 7d ago

Timeline8 articles

Breeze Comet Executes Hundreds of Fraudulent Transactions via Brazilian Payment Systems

Google/Mandiant profile Breeze Comet, a Brazil-based e-crime group executing fraudulent Pix and STR payment transactions at banks, retailers, and fintechs.

Google Threat Intelligence Group and Mandiant describe Breeze Comet (formerly UNC5669), a financially motivated threat actor active since September 2023 targeting Brazilian financial services, retail, and e-commerce. The group gains access via password spraying, vishing impersonating IT support to install RMM tools like AnyDesk, WhatsApp social engineering, and exploitation of vulnerable JBoss AS servers for web shell deployment. It uses compromised government websites as C2, deploys the Rust-based COBALTSPIN tunneler and multiple custom backdoors (LIGHTPAINT, MILDFROST, KICKPLATE, BOATBEAM), then clears logs after executing hundreds of fraudulent transactions through Pix, STR, and Boleto payment systems. At least one heist yielded tens of thousands of dollars, with infrastructure suggesting expansion toward Latin America and Africa.

The Hacker NewsSep 8, 11:22 UTC · 7d agoThreat actor in the wild

How Cyber Sleuths Tracked a Nigerian Scammer to His Doorstep

Cyber fraud fighters Erin West and Paul Raffile traveled to Nigeria to identify a scammer, uncovering more than just his identity.

404 Media reports that fraud investigators Erin West and Paul Raffile traveled to Nigeria to track down an online scammer. The on-the-ground investigation revealed more than the scammer's identity, offering a rare look at how scam operations run. The piece is an investigative narrative with no immediate technical risk to defenders.

404 MediaAug 31, 12:21 UTC · 15d agoPhishing & fraud

INTERPOL Operation Jackal IV Arrests 58, Identifies 263 in Global Cyber Fraud Crackdown

INTERPOL's Operation Jackal IV arrested 58 and identified 263 suspects in West African cyber-fraud networks, seizing millions across 22 countries.

Operation Jackal IV, run by INTERPOL with 22 countries between November 2025 and June 2026, targeted West African organized crime groups such as Black Ace behind romance, investment, and business email compromise fraud. It produced 58 arrests and 263 identified suspects, including 17 arrests tied to a crime-as-a-service network providing domains and money laundering support to 196 identified individuals. Raids in Johannesburg netted 39 arrests, $2.67 million seized, and 257 blocked bank accounts, while a Romanian call-center investment scheme had stolen an estimated 143 million euros (~$166 million) and led to 11 arrests. The operation is the fourth iteration, following waves in 2022, 2023, and 2024 with 75, 103, and 300 arrests respectively.

The Hacker NewsAug 26, 13:31 UTC · 20d agoPolicy & legal

Interpol's Jackal IV Disrupts West African Crime Infrastructure

Interpol's Operation Jackal IV disrupted crime-as-a-service infrastructure in West Africa used by networks such as Black Axe.

Interpol coordinated Operation Jackal IV, an international law enforcement action targeting cybercrime infrastructure in West Africa. The operation focused on disrupting crime-as-a-service networks, including infrastructure supporting groups like Black Axe. Dark Reading's threat intelligence desk reported on the disruption of the criminal networks' operational capability.

Dark ReadingAug 26, 08:30 UTC · 20d agoPolicy & legal

Nigeria Looks to Sovereign Cloud for Cyber, National Security

Nigeria launches financing, procurement, and infrastructure policies to build a sovereign cloud for cyber and national security.

Nigeria has introduced financing, procurement, and infrastructure policies to accelerate its sovereign cloud initiative. The program aims to keep government data under national control and expand domestic technical expertise. It is framed as part of a broader effort to strengthen cyber and national security capabilities in West Africa's largest economy.

Dark ReadingAug 26, 08:00 UTC · 21d agoPolicy & legal

Two CVSS 9.8 Auth Bypasses in miniOrange SAML WordPress Plugin Were Exploited Before Any Database Even Listed the Paid Editions as Vulnerable

Attackers actively exploit two CVSS 9.8 auth bypasses (CVE-2026-61979, CVE-2026-15981) in the miniOrange SAML WordPress plugin, forging SAML responses to become admin.

CVE-2026-61979 is a SAML algorithm confusion flaw that lets attackers sign forged assertions using the identity provider's RSA public key as an HMAC secret; CVE-2026-15981 stems from PHP treating openssl_verify()'s -1 error return as true, allowing a crafted signature that triggers an OpenSSL error to validate. Both bugs independently let unauthenticated attackers obtain WordPress administrator sessions and both are confirmed exploited in the wild. DigitalOcean discovered the exploitation via a network anomaly after public vulnerability databases covered only the Free edition (fixed in 5.4.5), leaving seven independently versioned paid editions appearing patched. Attackers are scanning SSO endpoints from six IPs in Belgium, Nigeria, the US and Germany, and paid-edition fixes require manual uploads across version lines.

Security AffairsAug 25, 16:43 UTC · 21d agoExploit / PoC in the wildCVE-2026-61979 CVE-2026-15981

Africa’s Cybersecurity Challenge Is Bigger Than Access to Technology

Rapid7 partners with distributor StarLink to expand managed security operations support across Middle East and Africa markets.

Rapid7's Middle East & Africa regional director argues that cloud, AI and digital adoption in markets like Egypt, Nigeria and Kenya is outpacing security teams' capacity, context and specialist staffing. The piece frames Rapid7's distribution partnership with StarLink as a way to help regional organizations convert existing tooling into faster investigations and more consistent response rather than buying more products.

Rapid7 BlogAug 17, 08:00 UTC · Aug 17, 2026Industry

ExfilSquad Targets New Victims, Shares Data via Torrents

Extortion group ExfilSquad lists 13 new US, UK and Swedish victims and now distributes stolen data via peer-to-peer torrents.

ExfilSquad, a data-theft extortion collective that emerged in mid-2026, announced 13 new victims in the US, UK and Sweden with an August 5, 2026 negotiation deadline. The group skips ransomware, instead stealing data and threatening publication on a dark web leak site. Resecurity says its TTPs center on exploiting misconfigured Microsoft Dataverse, Power Pages, case management and CRM portals. The group now distributes stolen data through per-victim torrent trackers and web seeds, making leaks hard to contain.

Security AffairsAug 11, 16:45 UTC · Aug 11, 2026Threat actor in the wild

Related CVEsby mentions

CVE-2026-159819.8<1%
The SAML Single Sign On – SSO Login plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 5.4.4.
The SAML Single Sign On – SSO Login plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 5.4.4. This is due to the mo_saml_validate_signature() function performing a loose boolean check on the raw tri-state integer returned by PHP's openssl_verify(), causing an error return value of -1 to be evaluated as truthy and therefore treated as a successful signature verification. This makes it possible for unauthenticated attackers to log in as any existing WordPress user, including administrators, by submitting a crafted SAMLResponse containing an…
· WordPress—
CVE-2026-619798.1<1%
Unauthenticated privilege escalation in miniOrange SAML SSO WordPress plugin
CVE-2026-61979 is an unauthenticated privilege-escalation flaw (CWE-266, incorrect assignment of privileges) in the miniOrange 'SAML SP Single Sign On' plugin for WordPress, affecting every version up to and including 5.4.3. Because it is reachable over the network with no privileges required and no user interaction (the CVSS 3.1 vector rates attack complexity as high), a remote attacker can abuse the plugin's SAML single sign-on handling to gain WordPress administrator-level privileges without valid credentials. With administrator access, an attacker can modify content, install plugins or themes, create rogue admin accounts, and use the site as a foothold. Any WordPress site running the affected versions is exposed, and reporting indicates the plugin's paid editions were also vulnerable to related flaws in the same campaign. No public proof-of-concept is known for this specific flaw and it is not in CISA KEV (EPSS ~0.3% over 30 days), but two separate CVSS 9.8 authentication-bypass flaws in the same plugin were exploited in the wild before they were even catalogued, and attackers are actively targeting miniOrange SAML flaws that grant WordPress admin access.
· miniOrange SAML SP Single Sign On (WordPress plugin) <= 5.4.3 · miniOrange SAML SP Single Sign On - paid/premium editions (reported alongside the actively exploited related flaws)large

Appears with

organization Interpol 2 threat actor Black Axe 2 threat actor Cl0p 1 threat actor ExfilSquad 1 threat actor LockBit 1 threat actor Nigerian scammer 1 threat actor SHADOW-AETHER-064 1 malware XWorm 1 threat actor UNC5669 1 malware BOATBEAM 1 malware COBALTSPIN 1 malware KICKPLATE 1 malware LIGHTPAINT 1 malware MILDFROST 1 threat actor Plump Spider 1 threat actor CL-CRI-1163 1

Entities are extracted by the model from each article. Watching an entity keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.