Threat Intel
Black Axe Syndicate Leaders Extradited to U.S. on Wire Fraud and Money Laundering Charges
Five alleged leaders of the notorious Black Axe cybercrime gang were flown from South Africa to the United States on September 11 to face wire‑fraud, money‑laundering and aggravated identity‑theft charges. Prosecutors say the group ran a decade‑long romance‑scam scheme that tricked U.S. victims into sending money, using social‑media profiles, dating sites and VoIP calls. The extradition follows a global operation that saw 58 arrests across 22 countries, highlighting the U.S. commitment to bring transnational fraudsters to justice.
Five men tied to the Black Axe cybercrime syndicate have been extradited from South Africa to the United States to answer federal charges that could rack up 20‑year prison terms each. The defendants—Perry Osagiede, Franklyn Osagiede, Osariemen Clement, Collins Otughwor and Musa Mudashiru—were arrested in 2021 at the U.S. request and flown over on September 11.
Decade‑long romance‑scam operation
According to prosecutors, the gang ran an internet‑fraud campaign out of Cape Town from 2011 to 2021 that preyed on U.S. residents. Using fake social‑media accounts, dating‑site profiles and VoIP phone numbers, the operators convinced victims they were in a romantic relationship. When the targets refused to pay, the gang threatened to release compromising photos and other personal data.
Charges and potential penalties
- Wire fraud – up to 20 years
- Money laundering – up to 20 years
- Aggravated identity theft – additional 2 years
"The ability of FBI Newark and our partner agencies to reach into South Africa illustrates our resolve to hold accountable any and every type of fraudster who preys on innocent victims here in the United States," said FBI Newark Special Agent Stefanie Roddy.
Global crackdown on Black Axe
Last month, Operation Jackal IV saw law‑enforcement agencies in 22 countries arrest 58 individuals and identify 263 suspects linked to the syndicate’s web of money mules and facilitators. Spanish authorities alone detained 34 suspects believed to be part of the same network.
Founded in 1977 in Nigeria, Black Axe has grown into one of the world’s most dangerous cyber‑crime rings, boasting an estimated 30,000 members. In January 2024, a U.S. court sentenced fellow member Olugbenga Lawal to ten years for laundering millions stolen from elderly Americans.
The extradition of these five leaders signals the U.S.’s determination to disrupt the gang’s global operations and protect U.S. citizens from sophisticated financial fraud.
Related articles
PhantomRaven: Bug‑Bounty Hunter Turns AI‑Generated Stealer Into Profit Machine
A financially motivated threat actor, posing as a bug‑bounty hunter, has crafted and distributed the JavaScript‑based information stealer PhantomRaven. Leveraging large‑language‑model code generation, the tool harvests credentials, session tokens and other sensitive data from compromised web pages. CrowdStrike’s analysis reveals the actor’s distribution tactics, the malware’s persistence mechanisms, and actionable detection and mitigation steps for defenders.
Read briefing
Ukrainian Conti Ransomware Operative Gets 4 Years Behind Bars
A 44‑year‑old Ukrainian national, Oleksii Lytvynenko, was sentenced to four years in U.S. prison for his role in the Conti ransomware campaign that hit over 1,000 victims worldwide and raked in more than $150 million in ransom. Arrested in Ireland and extradited to the U.S., Lytvynenko admitted to developing a loader, managing stolen data, and sending ransom notes between 2021‑2022. The case underscores the growing pressure on Conti’s remnants and the broader crackdown on the cyber‑crime syndicate that spawned groups like BlackCat and Hive.
Read briefing
Chinese‑speaking gang hijacks Brazilian government sites to weaponise SEO for phishing and gambling scams
Since mid‑2025, a Chinese‑speaking cyber‑crime cluster dubbed Gambling Goblin has been infiltrating Brazilian government and educational web servers. By installing custom Apache modules, the attackers silently reverse‑proxy visitors to a vast network of phishing pages that masquerade as trusted app stores. The compromised high‑reputation domains are then leveraged to boost the attackers’ own content in search results, driving traffic to gambling and sports‑betting sites. The group deploys a heavily obfuscated Linux toolkit—including backdoors, credential stealers and reconnaissance agents—maki
Read briefing
StopAndProtect: Ransomware Operation Hijacking Thousands of WordPress Sites
RootPwn’s latest intel uncovers StopAndProtect, a multi‑stage ransomware campaign that exploits compromised WordPress sites for download, command & control, and data exfiltration. The attack chain starts with a ClickFix social‑engineering lure that forces victims to run a PowerShell command, spawning .NET loaders, a SMB/USB worm, a lock‑screen module, a VBS spreader, a chat utility and a credential stealer. While not all victims receive file encryption, attackers silently harvest documents, logs and screenshots, uploading them to the same compromised sites. OPSEC lapses exposed thousands of IP
Read briefing