Nigerian Scammers Evolve with the Times, Move on to BEC and RATs

The Nigerian cyber-crime scene, famous for its Nigerian Prince and 419 scam tactics, has evolved to using malware and is now actively targeting enterprises using BEC (Business Email Compromise) techniques, a SecureWorks investigation has revealed.

For many years, the Internet has been plagued by massive spam floods, in most instances carrying emails from Nigerian cyber-crime crews that were trying to extort and fool home users into sending them money via various methods. Historically, these crews have been calling themselves "yahoo-yahoo boys," "yahoo boiz," or "G-boys."

As time passed and as the Internet population got more educated, their tactics became known and entered the Internet lore. As such, a change was needed.

Nigerian scammers shift focus to businesses

Riding the rising wave of BEC scams, Nigerian scam...

nmap -sV --script vuln -p- <target-network>

tail -f /var/log/suricata/fast.log | grep <cve>

Check Vendor Security Advisory Bulletin

title: Detect Exploitation - Nigerian Scammers Evolve with the Times, Move on to BEC and RATs
id: b046400c-ed97-4457-8a92-59ed9679c9db
status: experimental
description: Automatisch generierte SIEM-Erkennungsregel basierend auf CTI Intelligence
references:
  - https://tsecurity.de/
author: iShareStuff CTI Automated Detection Engine
date: 2026-09-24
logsource:
  category: network_connection
  product: any
detection:
  selection:
      CommandLine|contains:
        - 'exploit'
  condition: selection
falsepositives:
  - Legitime administrative Zugriffe oder Penetrationstests
level: high
tags:
  - attack.initial_access

rule CTI_Threat_Indicator {
    meta:
        author = "iShareStuff CTI Automated Detection Engine"
        date = "2026-09-24"
        description = "YARA Signature for "
    strings:
        $str = "Nigerian Scammers Evolve with " ascii wide
    condition:
        any of them
}