Loading threat actor…
Black Axe, formally associated with the Neo Black Movement of Africa, is a highly structured transnational organized-crime network of Nigerian origin with operations across Africa, Europe, and other regions. The group is organized into regional chapters commonly called zones and is linked to cyber-enabled financial crime, including romance scams, advance-fee fraud, business email compromise, investment and cryptocurrency fraud, identity theft, and money laundering. Black Axe operations use fraudulent personas, social-media and dating platforms, aliases, and internet-based communications to deceive victims and induce payments. Members and facilitators have used mule accounts, victim-controlled accounts, business entities, remittance mechanisms, and other financial infrastructure to move and obscure criminal proceeds. Black Axe has also been associated with coercive extortion in which victims are threatened with disclosure of sensitive images. Law-enforcement actions have targeted Black Axe leaders, members, facilitators, and laundering infrastructure in multiple countries. The organization has also been linked to serious non-cyber criminal activity, including violent crime, trafficking, kidnapping, armed robbery, and drug trafficking.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
Attributed origin per open-source reporting.
13 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Alleged leaders of the Cape Town zone are charged in the United States with operating romance scams, advance-fee fraud, wire-fraud conspiracy, money-laundering conspiracy, and identity theft. From Cape Town between 2011 and 2021, they allegedly used social media, dating platforms, VoIP numbers, fraudulent personas, victim and other US bank accounts, and business entities to defraud US victims and launder proceeds, including proceeds connected to business email compromise. The FBI describes Black Axe as a violent transnational criminal organization that also conducts romance scams for revenue.
Allegedly conducted lucrative romance-scam operations that stole thousands of dollars from more than 100 victims; five alleged members were extradited from South Africa to face charges.
A transnational cybercrime syndicate involved in global cyber-enabled financial fraud, including advance-fee fraud, romance scams, sextortion-style coercion, money laundering, and use of money mules and facilitators.
A transnational criminal organization whose Cape Town branch allegedly conducted romance scams against U.S. residents, used social-media and dating-site personas to defraud and extort victims, and laundered proceeds through South African companies and victim-created bank accounts. Prosecutors also traced laundered funds to business-email-compromise fraud.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.