- Category
- Criminal · Financially motivated: ransomware, fraud and theft.
- Origin
- Nigeria(medium confidence)
- Sources
- 4 sources carry it
- Identifier
- GINC-APT-0529 · gold-skyline
What it is
GOLD SKYLINE is a financially motivated cybercriminal threat group operating from Nigeria engaged in high-value wire fraud facilitated by business email compromise (BEC) and spoofing (BES). Also known as Wire-Wire Group 1 (WWG1), GOLD SKYLINE has been active since at least 2016 and relies heavily on compromised email accounts, social engineering, and increasingly malware to divert inter-organization funds transfers.
Names
The names each vendor, agency and source gives it. Naming differs by who tracks the actor, so one group carries many.
- Secureworks
- TG-2798
- Other names
- Ojie Victor, Wire-Wire Group 1, Yahoo Boys
Attribution
Each attribution is a claim: who makes it, and to whom. Western and Eastern sources are kept apart, as they often disagree.
Western sources
Tools
The tools and malware families the sources tie to it.
- Cyber Eye RAT
- CyberGate
Sources
- Malpedia malpedia.caad.fkie.fraunhofer.de