Loading story…
Swiss authorities arrested 10 suspected members of the Nigerian criminal organisation Black Axe in coordinated raids across several cantons, including the group’s alleged Regional Head for Southern Europe. Prosecutors and police in Zurich said the suspects were tied to romance scams, other cyber-enabled fraud schemes, and money laundering that caused losses of millions of Swiss francs.
The Swiss-led investigation was carried out with German law enforcement and supported by Europol, which provided intelligence analysis, cross-border coordination, and a data sprint in Madrid to map the group’s structure and links to related cases, including in Spain. Authorities described Black Axe as a highly structured transnational network with global reach and criminal proceeds estimated in the billions of euros, and said the operation aimed to disrupt its distributed model and support asset seizures with assistance from the EU-funded @ON Network.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
1 event from the most recent confirmed update back to the earliest known activity.
On 28 April 2026, Swiss authorities carried out coordinated searches across several cantons and arrested 10 suspects linked to the Black Axe criminal organisation, including its alleged Regional Head for Southern Europe. The suspects were accused of romance scams, other cyber fraud offences, and money laundering tied to millions of Swiss francs in losses.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
europol.europa.eu
Open sourcehelpnetsecurity.com
Open sourcezh.ch
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Spanish National Police, in collaboration with German authorities and Europol, arrested 34 individuals linked to the Black Axe criminal organization in a coordinated operation across Seville, Madrid, Málaga, and Barcelona. The suspects, primarily of Nigerian origin, are accused of orchestrating large-scale cyber fraud schemes, including business email compromise (BEC), romance scams, and phishing attacks, resulting in nearly €6 million in losses in Spain alone. Authorities seized cash, electronic devices, vehicles, and froze significant sums in bank accounts during the raids, while also uncovering the group's strategy of recruiting vulnerable locals as money mules to launder illicit proceeds. The Black Axe group, originating from Nigeria and now boasting an estimated 30,000 members worldwide, has been implicated in a range of criminal activities, with cyber-enabled fraud as a major revenue stream. The investigation revealed that the Spanish cell was part of a broader European network, using sophisticated man-in-the-middle (MITM) tactics to intercept and redirect corporate payments. Four main suspects have been placed in pretrial detention, facing charges including aggravated fraud, money laundering, and membership in a criminal organization, while authorities continue to pursue additional leads and potential arrests.
Jun 29, 2026
**INTERPOL’s Operation Red Card 2.0**, coordinated under the **African Joint Operation against Cybercrime (AFJOC)**, resulted in **651 arrests** across **16 African countries** and the recovery of **over $4.3 million** tied to online scam activity. The operation ran from **December 8, 2025 to January 30, 2026**, identified **1,247 victims**, and targeted criminal activity linked to **over $45 million** in losses, including **high-yield investment fraud**, **mobile money fraud**, and **fraudulent mobile loan applications**. Law enforcement reported significant disruption activity, including the seizure of **2,341 devices** and takedowns of **1,442 malicious IPs/domains/servers (and related infrastructure)**. Notable actions included Nigeria dismantling an investment-fraud ring that leveraged **phishing, identity theft, and social engineering** (with **1,000+ fraudulent social media accounts** removed) and arresting **six suspects** accused of breaching a major telecom provider using **compromised staff credentials** to steal airtime/data for resale; Kenya arrested **27 suspects** tied to social-media/messaging-driven fraud schemes; and Côte d’Ivoire arrested **58 suspects** linked to predatory loan-app activity with hidden fees and abusive collection practices.
Jun 29, 2026
Law enforcement agencies across 19 African countries, coordinated by INTERPOL under Operation Sentinel, arrested 574 suspects and recovered approximately $3 million in a sweeping crackdown on cybercrime. The month-long operation targeted business email compromise (BEC), digital extortion, and ransomware, resulting in the takedown of over 6,000 malicious links and the decryption of six ransomware variants. Notable incidents included the prevention of a $7.9 million BEC fraud at a Senegalese petroleum company, a ransomware attack on a Ghanaian financial institution that encrypted 100 terabytes of data, and the dismantling of a cross-border scam in Ghana and Nigeria that defrauded over 200 victims. Authorities also seized more than 100 digital devices, took down 30 servers, and shut down thousands of scam-linked social media accounts, with total financial losses from investigated cases exceeding $21 million. The operation highlighted the increasing scale and sophistication of cyberattacks targeting critical sectors such as finance and energy across Africa. International cooperation and rapid response were key to the operation's success, with support from private sector partners including Team Cymru, The Shadowserver Foundation, Trend Micro, TRM Labs, and Uppsala Security. The results demonstrate a strong commitment by African law enforcement and their international partners to combat cybercrime and protect digital infrastructure in the region.
Jun 29, 2026