The December 2022 issue of IEEE Spectrum is here!

Close bar

Nigerian Scammers Infect Themselves With Own Malware, Revealing New "Wire-Wire" Fraud Scheme

Wire-wire attack is more sophisticated and harder to detect than previous Business Email Compromise scams

3 min read
keyboard with Nigerian flag to illustrate story about new wire-wire scams
Photo: iStockphoto

A pair of security researchers recently uncovered a Nigerian scammer ring that they say operates a new kind of attack called “wire-wire” after a few of its members accidentally infected themselves with their own malware. Over the past several months, they’ve watched from a virtual front row seat as members used this technique to steal hundreds of thousands of dollars from small and medium-size businesses worldwide.  

“We've gotten unprecedented insight into the very nitty-gritty mechanics of their entire operation,” says James Bettke, a researcher at SecureWorks, a subsidiary of Dell focused on cybersecurity. Bettke and Joe Stewart, who directs malware research for SecureWorks, are presenting the details of their findings this week at the annual Black Hat security conference in Las Vegas.

This new type of attack is a twist on an old favorite. For years, rings of scammers in West Africa have stolen money from companies through a technique known as “Business Email Compromise,” or BEC, in which they use internal corporate email accounts to execute fraudulent financial transactions. Or, in another approach known as “spoofing,” scammers have impersonated a CEO’s email from an external account to persuade an employee to send a wire transfer to their own bank account. 

The SecureWorks experts say that wire-wire, which is how criminals refer to the new type of attack, represents a more sophisticated approach to BEC that is harder to detect. Bettke and Stewart discovered the ring in February when five of the scammers self-infected their own computers with the same malware they were using to steal from others. Such errors are a surprisingly common way for security researchers to get an inside look at scammers’ operations.

For months, the malware automatically loaded screenshots and keystrokes from compromised computers to an open Web database. One of the infected scammers also frequently trained new scammers, which revealed even more details about their techniques. The SecureWorks team initially found the database by using the virus scanning tool VirusTotal to search for suspicious email attachments.

The wire-wire scammers begin by using a simple marketing tool to scrape the email addresses of businesses and employees from corporate websites. Then, they blast these addresses with messages containing keylogger software or other malware in a process called “bombing.” Employees who click on a malicious link or open an infected attachment might be prompted to log in, providing scammers with the password to their email accounts.


Once they’re in, the scammers allow the employee to continue with business as usual and discreetly monitor the account for potential financial transactions. As soon as they see that the employee is sending an invoice to a customer, they reroute it through their own email account and physically alter the account number and routing number before forwarding it on to the customer. The email address they use is often very similar to the original email address, so it’s easy to miss. Unlike spoofing, BEC techniques such as wire-wire rely on earning internal account access rather than externally impersonating a company account.

Since February, the SecureWorks team has witnessed the thieves deploy this method to reroute transactions averaging between US $30,000 and $60,000 from mostly small and medium-size businesses making international deals. In one case, the attackers rerouted a $400,000 payment from a U.S. chemical company to its Indian supplier.

Bettke and Stewart estimate that the group they studied has at least 30 members and is likely earning a total of about $3 million a year from the thefts. The scammers appear to be “family men” in their late 20s to 40s who are well-respected, churchgoing figures in their communities. “They're increasing the economic potential of the region they're living in by doing this, and I think they feel somewhat of a duty to do this,” Stewart says.

After the fact, it can take a while before the customer and seller realize they’ve been scammed. Often, neither buyer or seller realizes that something is amiss until the shipment or payment is overdue. Given their vantage point, Stewart and Bettke have tried to alert some businesses to the scam before the fraudulent transactions are complete, but they sometimes have a hard time persuading employees that they aren’t scammers themselves.

The SecureWorks team has notified Nigeria’s Economic and Financial Crimes Commission, and their description of wire-wire scamming has led to at least one active investigation. They say the easiest way for business owners to prevent such attacks is to require two-step verification for employee logins. Stewart and Bettke have also uploaded a program to GitHub that detects digital artifacts that remain on an altered invoice to tip employees off to suspicious activity.

The Conversation (0)

Metamaterials Could Solve One of 6G’s Big Problems

There’s plenty of bandwidth available if we use reconfigurable intelligent surfaces

12 min read
An illustration depicting cellphone users at street level in a city, with wireless signals reaching them via reflecting surfaces.

Ground level in a typical urban canyon, shielded by tall buildings, will be inaccessible to some 6G frequencies. Deft placement of reconfigurable intelligent surfaces [yellow] will enable the signals to pervade these areas.

Chris Philpot

For all the tumultuous revolution in wireless technology over the past several decades, there have been a couple of constants. One is the overcrowding of radio bands, and the other is the move to escape that congestion by exploiting higher and higher frequencies. And today, as engineers roll out 5G and plan for 6G wireless, they find themselves at a crossroads: After years of designing superefficient transmitters and receivers, and of compensating for the signal losses at the end points of a radio channel, they’re beginning to realize that they are approaching the practical limits of transmitter and receiver efficiency. From now on, to get high performance as we go to higher frequencies, we will need to engineer the wireless channel itself. But how can we possibly engineer and control a wireless environment, which is determined by a host of factors, many of them random and therefore unpredictable?

Perhaps the most promising solution, right now, is to use reconfigurable intelligent surfaces. These are planar structures typically ranging in size from about 100 square centimeters to about 5 square meters or more, depending on the frequency and other factors. These surfaces use advanced substances called metamaterials to reflect and refract electromagnetic waves. Thin two-dimensional metamaterials, known as metasurfaces, can be designed to sense the local electromagnetic environment and tune the wave’s key properties, such as its amplitude, phase, and polarization, as the wave is reflected or refracted by the surface. So as the waves fall on such a surface, it can alter the incident waves’ direction so as to strengthen the channel. In fact, these metasurfaces can be programmed to make these changes dynamically, reconfiguring the signal in real time in response to changes in the wireless channel. Think of reconfigurable intelligent surfaces as the next evolution of the repeater concept.

Keep Reading ↓Show less