Loading threat actor…
Black Axe is a highly structured transnational criminal organization originating in Nigeria and widely linked to the Neo-Black Movement of Africa. It operates through a hierarchical, zone-based model with an international footprint spanning dozens of countries, and has been repeatedly associated with cyber-enabled fraud alongside other serious organized crime activity. Reported criminal activity includes business email compromise, adversary-in-the-middle and man-in-the-middle fraud, romance scams, phishing, money laundering, and the recruitment and use of money mules to receive, transfer, and withdraw illicit proceeds. Authorities have also linked the organization to non-cyber crimes including drug trafficking, human trafficking, prostitution, kidnapping, armed robbery, and related criminal facilitation. In Europe, Black Axe has been the subject of major coordinated law-enforcement actions, including operations in Spain and Switzerland. Investigations in Spain tied the network to millions of euros in fraud losses and described a core group of Nigerian nationals directing cyber-fraud operations while exploiting vulnerable local recruits as money mules, particularly in economically depressed areas. Swiss authorities similarly linked Black Axe members to romance scams, other cyber fraud offenses, and money laundering, including the arrest of an alleged regional leader for Southern Europe. Europol has characterized the group as globally distributed, disciplined, and resilient, relying both on formal members and affiliated facilitators. Black Axe’s cybercrime tradecraft centers on social-engineering-enabled financial fraud rather than disruptive or destructive intrusion activity. Documented operations include interception or impersonation of legitimate business communications to redirect payments, phishing-based credential capture, romance-fraud schemes, laundering through mule networks, and broader post-fraud financial concealment. The organization’s dominant motivation is financial gain.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
Attributed origin per open-source reporting.
16 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
International criminal organisation involved in cyber-enabled fraud including romance scams, money laundering, and other criminal activities such as drug trafficking, human trafficking, kidnapping, armed robbery, and fraudulent spiritual practices.
A highly structured transnational criminal network involved in cyber-enabled fraud, including romance scams and other cyber fraud offences, as well as money laundering and a broader portfolio of organized criminal activity.
Referenced as a criminal organization whose linked suspects were apprehended in separate Spanish operations; no specific TTPs described in this content.
Criminal network associated with cyber fraud; referenced as a connection to a broader crime ring.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.