SilverTerrier (TMT) Hacker Group

History

2022: Detention of the leader of the group with the support of Group-IB

On May 25, 2022, Interpol announced the detention of the alleged leader of the hacker group SilverTerrier (also known as TMT). The Russian company Group-IB took part in this international operation, called Delilah.

Group-IB experts provided law enforcement agencies with data that made it possible to identify the alleged leader of the group engaged in mass phishing mailings and compromising business mail (Business Email Compromise, BEC).

Photo of the suspect, Interpol

As a result, the operatives were able not only to identify the identity of the suspect - the 37-year-old leader of the group, but also got the opportunity to remotely monitor all the actions of the attacker on the network, including controlling his movements from one country to another. As a result, Nigeria's law enforcement agencies successfully detained the suspect at Murtala Muhammed International Airport in Lagos, and he was charged.

The arrest of the alleged cybercrime is evidence of both the professionalism and persistence of all participants in our international coalition - law enforcement agencies and Interpol partners - private companies, cybersecurity experts, "said Garba Baba Umar, head of the Interpol National Central Bureau in Nigeria.

According to Group-IB, the company has been monitoring the activities of the criminal group TMT since 2019. According to experts, by 2020, TMT compromised more than 500,000 e-mail addresses of public and private companies in more than 150 countries. For example, on the laptop of one of the suspects detained in Nigeria during Operation Falcon II, police found more than 800,000 credentials of potential victims.

Delilah is the third Interpol operation, conducted in close cooperation with the Nigerian police, experts from Group-IB, Palo Alto Networks and Trend Micro, against members of the TMT hacker network (SilverTerrier).^[1]

Notes