Global Cybercrime Crackdown Nets 58 Arrests: Defending Your Organization Against BEC and Transnational Fraud Networks

Law enforcement agencies spanning 22 countries have concluded a coordinated crackdown on cybercrime networks operated by African crime groups, identifying 263 suspects and arresting 58 individuals. The operation targeted the full kill chain of financially motivated cybercrime: business email compromise (BEC), romance and investment scams, phishing infrastructure, and the money mule networks that launder the proceeds.

For defenders, the headline matters less than the lesson: these networks are industrialized, transnational, and overwhelmingly dependent on a small set of repeatable techniques — compromised mailboxes, malicious inbox rules, lookalike domains, and social engineering of finance staff. Law enforcement can arrest operators, but arrests do not close the mailbox forwarding rule quietly siphoning your AP thread to an attacker-controlled Gmail account. That work belongs to your SOC.

This post breaks down the dominant TTPs used by these crime groups and gives you deployable detections — Sigma, KQL, and Velociraptor — plus a hardening script you can run today against Microsoft 365 environments, the most common BEC battleground.

Technical Analysis

What These Networks Actually Do

While the operation covered multiple fraud categories, the enterprise-facing threat breaks down into four recurring patterns observed across BEC and phishing campaigns run by West and Central African crime groups:

Credential phishing against cloud mailboxes. Victims receive lures (invoices, payment rerouting notices, HR documents) pointing to adversary-in-the-middle (AiTM) phishing pages that harvest session cookies, bypassing basic MFA. Stolen sessions are replayed from infrastructure geolocated far from the victim.
Mailbox rule manipulation. Once inside a mailbox, operators create hidden inbox rules that forward, redirect, or delete messages matching keywords like invoice, payment, wire, swift, or the compromised counterparty's domain. This lets the attacker intercept conversation threads invisibly.
Thread hijacking and payment redirection. Using the hijacked thread context, attackers inject fraudulent banking details from lookalike domains (often registered within days of use, frequently using homoglyph substitution of the target domain).
Money mule laundering. Funds are routed through layered mule accounts — the human infrastructure that this police operation primarily dismantled. Disrupting mule networks raises attacker cost but does not reduce your inbound attack volume.

Affected Platforms

There is no CVE here — this is technique-driven crime. The primary affected platforms are:

Microsoft 365 / Exchange Online (dominant BEC target)
Google Workspace (secondary target)
Any organization whose finance workflows rely on email-initiated payment changes

Exploitation Status

These are not theoretical techniques. The operation's scale — 263 identified suspects across 22 countries — confirms active, industrialized exploitation. BEC remains among the highest-dollar-loss categories reported to the FBI IC3 year over year, and AiTM phishing kits capable of defeating push-based MFA are commodity tooling in these ecosystems.

Detection & Response

The detections below target the two highest-fidelity, lowest-noise behaviors in the BEC kill chain: malicious inbox rule creation and impossible-travel / anomalous cloud sign-ins.

YAML

---
title: Suspicious Inbox Rule Created to Hide or Redirect Mail
tid: 3f2a1b94-7c5e-4d8a-b2f1-9e6c0a4d7b21
status: experimental
description: Detects creation of inbox rules that delete, move to obscure folders, or externally forward messages containing payment-related keywords — a hallmark of BEC thread hijacking by financially motivated crime groups.
references:
  - https://attack.mitre.org/techniques/T1114/002/
  - https://www.bleepingcomputer.com/news/security/police-arrests-dozens-of-suspects-in-global-cybercrime-crackdown/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.collection
  - attack.t1114.002
logsource:
  product: m365
  service: exchange
detection:
  selection_operation:
    Operation:
      - New-InboxRule
      - Set-InboxRule
  selection_action:
    Parameters|contains:
      - DeleteMessage
      - ForwardTo
      - RedirectTo
      - MoveToFolder
  selection_keywords:
    Parameters|contains:
      - 'invoice'
      - 'payment'
      - 'wire'
      - 'swift'
      - 'remittance'
      - 'bank'
      - 'account'
  condition: selection_operation and selection_action and selection_keywords
falsepositives:
  - Legitimate user-created filtering rules; baseline expected rules per user and alert on deviation
level: high
---
title: Mailbox Forwarding Configured to External Free Email Provider
tid: 8c4d2e61-1a9b-4f37-9c05-2d8b6e0f3a47
status: experimental
description: Detects mailbox forwarding or inbox rule redirection to free consumer email providers, a common exfiltration channel used by BEC operators to monitor hijacked threads.
references:
  - https://attack.mitre.org/techniques/T1114/003/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.exfiltration
  - attack.t1114.003
  - attack.collection
logsource:
  product: m365
  service: exchange
detection:
  selection_operation:
    Operation:
      - Set-Mailbox
      - New-InboxRule
      - Set-InboxRule
  selection_target:
    Parameters|contains:
      - 'gmail.com'
      - 'outlook.com'
      - 'hotmail.com'
      - 'yahoo.com'
      - 'protonmail.com'
      - 'proton.me'
      - 'aol.com'
  condition: selection_operation and selection_target
falsepositives:
  - Executives forwarding mail to personal accounts; suppress per-user after verification, never org-wide
level: high
---
title: AiTM Phishing Follow-On - Mailbox Access From Unusual ASN After New Rule Creation
tid: 5e1f8a02-9c74-4b6d-a318-7f0b2e9c5d63
status: experimental
description: Correlation placeholder for environments streaming M365 audit into a SIEM via Sigma pipelines — flags sign-in from hosting/VPN ASNs on accounts that recently created inbox rules.
references:
  - https://attack.mitre.org/techniques/T1557/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.credential_access
  - attack.t1557
  - attack.initial_access
logsource:
  product: azure
  service: signinlogs
detection:
  selection:
    risk_level: 'none'
    network_type|contains:
      - 'hosting'
      - 'vpn'
      - 'datacenter'
  filter_known:
    is_known_network: true
  condition: selection and not filter_known
falsepositives:
  - Corporate VPN egress, mobile carriers with CGNAT; tune against your known egress list before production
level: medium

KQL — Microsoft Sentinel / Defender

// Hunt: Inbox rules created with delete/forward/redirect actions on payment-related keywords
// Microsoft Sentinel — requires OfficeActivity (M365 audit) or CloudAppEvents (Defender for Cloud Apps)
let PaymentKeywords = dynamic(["invoice","payment","wire","swift","remittance","banking","account number","beneficiary"]);
let FreeMail = dynamic(["gmail.com","outlook.com","hotmail.com","yahoo.com","proton.me","protonmail.com","aol.com"]);
OfficeActivity
| where OfficeWorkload =~ "Exchange"
| where Operation in~ ("New-InboxRule","Set-InboxRule","Set-Mailbox")
| extend RuleParams = tostring(parse_json(Parameters))
| extend Raw = tostring(RawEventData)
| where Raw has_any (PaymentKeywords)
   and (Raw has_any ("DeleteMessage","ForwardTo","RedirectTo","MoveToFolder","ForwardingSmtpAddress")
        or Raw has_any (FreeMail))
| extend ClientIP = tostring(parse_json(RawEventData).ClientIP)
| project TimeGenerated, UserId = UserId, Operation, ClientIP, Raw
| join kind=leftouter (
    SigninLogs
    | where TimeGenerated > ago(7d)
    | summarize RecentSigninLocations = make_set(Location), RecentASNs = make_set(tostring(NetworkLocationDetails)) by UserPrincipalName
    ) on $left.UserId == $right.UserPrincipalName
| order by TimeGenerated desc

VQL — Velociraptor

-- Hunt: Processes accessing browser credential stores — infostealer behavior
-- used to harvest the initial credentials sold/used by fraud networks
SELECT Pid, Name, Exe, CommandLine, Username,
       CreateTime
FROM pslist()
WHERE CommandLine =~ '(?i)(Login Data|Cookies|Web Data|Local State)'
   OR CommandLine =~ '(?i)(vaultcmd|dpapi|credman)'
   OR (Name =~ '(?i)(powershell|cmd|wscript|cscript|rundll32)' AND
       CommandLine =~ '(?i)(AppData..(Local|Roaming)..(Google|Microsoft..Edge|Brave|Opera))')

PowerShell

# BEC mailbox hygiene audit — run with ExchangeOnlineManagement module
# Requires Exchange Admin or Global Reader + Exchange perms
Connect-ExchangeOnline

$report = @()
$mailboxes = Get-EXOMailbox -ResultSize Unlimited -RecipientTypeDetails UserMailbox,SharedMailbox

foreach ($mbx in $mailboxes) {
    # Flag mailboxes with SMTP forwarding configured
    if ($mbx.ForwardingSmtpAddress -or $mbx.ForwardingAddress) {
        $report += [pscustomobject]@{
            Mailbox = $mbx.PrimarySmtpAddress
            Issue   = "SMTP forwarding configured"
            Detail  = "$($mbx.ForwardingAddress) $($mbx.ForwardingSmtpAddress)"
        }
    }
    # Flag inbox rules that forward/redirect externally or delete messages
    Get-InboxRule -Mailbox $mbx.PrimarySmtpAddress -ErrorAction SilentlyContinue | ForEach-Object {
        if ($_.ForwardTo -or $_.RedirectTo -or $_.ForwardAsAttachmentTo -or $_.DeleteMessage) {
            $report += [pscustomobject]@{
                Mailbox = $mbx.PrimarySmtpAddress
                Issue   = "Suspicious inbox rule: $($_.Name)"
                Detail  = "Fwd:$($_.ForwardTo) Redir:$($_.RedirectTo) Del:$($_.DeleteMessage)"
            }
        }
    }
}
$report | Export-Csv -Path "BEC-MailboxAudit-$(Get-Date -Format yyyyMMdd).csv" -NoTypeInformation
$report | Format-Table -AutoSize

# Optional: remove a confirmed malicious rule (uncomment after IR validation)
# Remove-InboxRule -Mailbox victim@contoso.com -Identity "SuspiciousRuleName" -Confirm:$false
Disconnect-ExchangeOnline -Confirm:$false

Remediation

There is no patch for BEC — remediation is architectural and procedural. Prioritize in this order:

Enforce phishing-resistant MFA. Move finance, executive, and helpdesk accounts to FIDO2/passkeys or certificate-based auth. Push-based MFA is defeated by the AiTM kits these groups operate. Use Conditional Access token protection and sign-in frequency policies to invalidate stolen session cookies.
Block external auto-forwarding tenant-wide. In Exchange Online, set an outbound spam filter policy with automatic forwarding disabled (AutoForwardingMode: Off). Legitimate cases get documented exceptions, not blanket capability.
Alert on inbox rule creation. Wire the Sigma rules above into your M365 audit pipeline. Rule creation by a user who has never created a rule before, from an unfamiliar ASN, is a near-deterministic BEC signal.
Harden payment workflows. Out-of-band verification (call-back to a previously known number, never one supplied in the email thread) for any banking detail change. This single procedural control defeats the entire monetization model.
Deploy DMARC at p=reject with reporting, and monitor for lookalike domain registrations via CT log monitoring for your brand and key counterparties.
Report and preserve evidence. If you identify a fraudulent wire, contact your bank's fraud desk within 24-72 hours (recall windows matter), file with FBI IC3 (ic3.gov) or your national equivalent, and preserve full message headers and mailbox audit logs — operations like this one are built on victim reports.

Related Resources

Security Arsenal Managed SOC Services AlertMonitor Platform Book a SOC Assessment soc-mdr Intel Hub