Loading threat actor…
Black Axe is a financially motivated transnational organized-crime network originating in Nigeria and associated with the Neo Black Movement of Africa. It has a highly structured, hierarchical organization divided into regional chapters known as zones, including a Cape Town zone in South Africa. Its international operations rely on members, money mules, and other facilitators to conduct cyber-enabled fraud and move criminal proceeds across borders. The network is linked to romance scams, advance-fee fraud, business email compromise, investment and cryptocurrency fraud, identity theft, and money laundering. Its fraud operations use fabricated identities, social-media and online-dating platforms, and internet-based telephone services to establish trust and solicit payments. Romance and advance-fee schemes employ invented financial emergencies, work-related problems, and other pretexts. Some operations pressure victims through threats to distribute sensitive photographs. Proceeds are concealed and transferred through victim-controlled financial accounts, mule accounts, and business entities. Documented investigations involve victims in the United States and Switzerland. The Cape Town zone has been implicated in a prolonged campaign targeting U.S. residents between 2011 and 2021. Black Axe has been subject to coordinated international investigations, including INTERPOL's Operation Jackal and European enforcement actions. Beyond cyber-enabled financial crime, the organization is linked to drug and human trafficking, kidnapping, and armed robbery.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
Attributed origin per open-source reporting.
13 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Alleged leaders of the Cape Town zone are charged in the United States with operating romance scams, advance-fee fraud, wire-fraud conspiracy, money-laundering conspiracy, and identity theft. From Cape Town between 2011 and 2021, they allegedly used social media, dating platforms, VoIP numbers, fraudulent personas, victim and other US bank accounts, and business entities to defraud US victims and launder proceeds, including proceeds connected to business email compromise. The FBI describes Black Axe as a violent transnational criminal organization that also conducts romance scams for revenue.
Allegedly conducted lucrative romance-scam operations that stole thousands of dollars from more than 100 victims; five alleged members were extradited from South Africa to face charges.
A transnational cybercrime syndicate involved in global cyber-enabled financial fraud, including advance-fee fraud, romance scams, sextortion-style coercion, money laundering, and use of money mules and facilitators.
Five alleged members were extradited from South Africa and face wire fraud and money laundering charges. Prosecutors accuse them of operating romance scams from 2011 to 2021 that stole thousands of dollars from more than 100 victims. The men reportedly ran the organization's Cape Town branch.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.