Cosmic Lynx: The Nigerian BEC Gang That Went Upmarket
A sophisticated Nigerian threat actor called Cosmic Lynx pivoted from low-value email scams to high-precision BEC attacks against Fortune 500 executives, stealing $1.3 billion over two years by impersonating attorneys in fake M&A deals.
Background
Business Email Compromise evolved significantly between 2018 and 2020. Rather than targeting finance staff with crude CEO impersonation, Cosmic Lynx developed a two-actor method that combined CEO impersonation with a fake external legal counsel persona, adding a layer of social proof.
The Attack
Cosmic Lynx first identified CEO email addresses from LinkedIn and public filings, then sent emails impersonating the CEO telling a senior finance executive about a confidential acquisition. A second actor posed as an external attorney handling the deal and provided wire transfer instructions. Both actors used professional language and demonstrated knowledge of real M&A processes. The fake attorney persona used lookalike domains of real law firms. The gang targeted over 200 Fortune 500 companies across 46 countries, with average transfer requests of $1.27 million per target.
Response
Agari threat researchers discovered and published detailed analysis of Cosmic Lynx in 2020, including 46 BEC campaigns. Law enforcement in multiple countries investigated. The FBI included the operation in its annual IC3 BEC report. Several members were later arrested in international operations.
Outcome
Cosmic Lynx stole an estimated $1.3 billion before disruption. The operation demonstrated that BEC had evolved far beyond crude Nigerian prince scams into highly sophisticated, well-researched financial fraud conducted by organised crime groups.
Key Takeaways
- Two-actor BEC (CEO plus attorney) is highly convincing — verify any wire transfer regardless of how many people seem to approve
- Research on LinkedIn and company filings gives attackers enough information to craft extremely convincing scenarios
- Cross-border BEC operations involve organised crime groups with professional capabilities
- Wire transfer requests should always be verified via a phone call to a number from your internal directory — not from the email