GINC-APT-0529 · Criminal

GOLD SKYLINE

Also Ojie Victor, TG-2798, Wire-Wire Group 1, Yahoo Boys.

Category
Criminal · Financially motivated: ransomware, fraud and theft.
Origin
Nigeria(medium confidence)
Sources
4 sources carry it
Identifier
GINC-APT-0529 · gold-skyline

What it is

GOLD SKYLINE is a financially motivated cybercriminal threat group operating from Nigeria engaged in high-value wire fraud facilitated by business email compromise (BEC) and spoofing (BES). Also known as Wire-Wire Group 1 (WWG1), GOLD SKYLINE has been active since at least 2016 and relies heavily on compromised email accounts, social engineering, and increasingly malware to divert inter-organization funds transfers.

Names

The names each vendor, agency and source gives it. Naming differs by who tracks the actor, so one group carries many.

Secureworks
TG-2798
Other names
Ojie Victor, Wire-Wire Group 1, Yahoo Boys

Attribution

Each attribution is a claim: who makes it, and to whom. Western and Eastern sources are kept apart, as they often disagree.

Tools

The tools and malware families the sources tie to it.

  • Cyber Eye RAT
  • CyberGate

Sources

  • Malpedia malpedia.caad.fkie.fraunhofer.de