Emerging ThreatsMalware & Ransomware

US Extradites Black Axe Leaders Over Internet Fraud Schemes

Analyst 207||Source: InfoSecMag
Law enforcement escorts a group of five formally dressed individuals in front of a courthouse.

"Black Axe is 'a notoriously violent transnational criminal organization that also happens to dabble in romance scams to make money,'" FBI Newark special agent in charge Stefanie Roddy said as U.S. authorities moved five alleged leaders from South Africa to federal court in New Jersey.

The five defendants extradited from South Africa

The U.S. Department of Justice says five Nigerian nationals who allegedly headed the Cape Town zone of the Neo Black Movement of Africa — commonly known as Black Axe — were flown from South Africa to the United States on September 11 and appeared in federal court in Trenton, New Jersey on September 14. The defendants named in the superseding indictment are Perry Osagiede, 57; Franklyn Edosa Osagiede, 42; Osariemen Eric Clement, 40; Collins Owhofasa Otughwor, 42; and Musa Mudashiru, 38. The DoJ said Perry Osagiede founded the Cape Town zone and served as its zonal head.

Alleged tactics: romance scams, VoIP, dating sites and a recurring construction-site script

According to the superseding indictment, the group operated from Cape Town between 2011 and 2021. Prosecutors allege they used social media, dating sites and Voice over Internet Protocol (VoIP) numbers to contact victims in the United States under a range of aliases. The indictment describes a commonly used script in which the caller posed as someone traveling to South Africa for work who then needed money after an unforeseen event — often described as a construction-site incident or involving a crane.

Victims who believed they were in relationships were said to have sent money and goods overseas. Where victims hesitated, prosecutors allege, conspirators coerced payment by threatening to distribute personally sensitive photographs. The indictment further alleges that funds were moved through the bank accounts of victims and other U.S. account holders; in some cases, victims were allegedly persuaded to open U.S. accounts that conspirators then used. Prosecutors also say business entities were used to disguise the flow of funds alongside proceeds from business email compromise (BEC).

Criminal counts and potential penalties

All five defendants are charged with wire fraud conspiracy and money laundering conspiracy, charges that the DoJ says each carry a possible sentence of up to 20 years. The superseding indictment adds individual wire fraud counts against Perry Osagiede, Franklyn Osagiede and Osariemen Eric Clement. Perry Osagiede, Franklyn Osagiede and Collins Otughwor also face aggravated identity theft counts; aggravated identity theft carries a mandatory two-year sentence that must run consecutively to any other term. The DoJ emphasized that the charges are accusations and that the defendants are presumed innocent unless and until proven guilty.

Law enforcement partners and the procedural timeline

The five were arrested in South Africa in 2021 at the request of U.S. authorities, five years before the extradition, the DoJ said. The department credited the investigation and action to a partnership of agencies: the Federal Bureau of Investigation, the U.S. Secret Service, South Africa's Hawks, the South African Police Service and Interpol. Following the extradition, the DoJ published a questionnaire for anyone who believes they were a victim of the alleged scheme.

What this means for U.S. victims, law enforcement, and financial institutions

  • U.S. victims: The DoJ’s published questionnaire provides a concrete avenue for anyone who believes they were targeted to report details to investigators and preserve possible evidence tied to transactions and communications.
  • Law enforcement: The case highlights cross-border investigative work — arrests in 2021, cooperation with South African authorities, and extradition to face federal charges in New Jersey — and underscores continued multiagency reliance on international partners and Interpol notices.
  • Financial institutions: Prosecutors allege the conspirators moved funds through victim and third-party U.S. accounts and used business entities to disguise proceeds, a pattern that implicates account-monitoring and suspicious-activity reporting in fraud investigations.

The defendants now face a U.S. federal prosecution in Trenton. Beyond the courtroom calendar, the case juxtaposes two frames: a Department of Justice prosecution centered on wire fraud, money laundering and identity theft charges, and the FBI’s characterization of Black Axe as a violent transnational criminal organization that also used romance scams as a revenue stream. The DoJ’s outreach to potential victims signals an investigative phase that may broaden as more alleged victims and transactional records are identified; until a court determines guilt, the charges remain allegations.

Source: Infosecurity Magazine — Black Axe Members Extradited to US Over Internet Fraud Claims

Emerging ThreatsOrganized CrimeUS Department Of JusticeExtraditionTransnational CrimeRomance ScamsNigeriaSouth AfricaBlack AxeInternet Fraud
Related Intelligence

Continue Reading

Person sits at corporate office desk with laptop, papers, and office supplies near a window.

Fraudulent Hires Evade Detection, Gain Network Access Before Exposure

Imagine getting hired, passing background checks, and receiving your official login credentials - all without being who you claim to be. Once inside, malicious hires can wreak havoc for days, with the average fraudulent employee enjoying 5.73 days of unrestricted access to sensitive corporate networks.

Analyst 207
Rows of equipment racks and Cisco Secure Email Gateway appliances in a brightly-lit server room with daylight from tall…

Cisco Email Gateways Exploited by Malicious Emails

A single malicious email can wreak havoc on your Cisco Secure Email Gateway, thanks to a critical vulnerability (CVE-2026-76461) that allows hackers to gain root access with a 9.8 CVSS score - and patching is the only fix.

Analyst 207
Dimly lit industrial control room with rows of network equipment and controllers.

BambooToken Malware Exploits MQTT for Global Command-and-Control

Meet BambooToken, a sneaky new malware framework that's been secretly weaponizing the Internet of Things messaging protocol MQTT to control servers worldwide since 2023. Its operators have cleverly leveraged MQTT's lightweight design to pull off global command-and-control attacks on both Windows and Linux servers.

Analyst 207
Laptop on a clean desk with a blurred screen, hinting at a web development workspace.

Hackers Exploit WooCommerce Plugin to Upload PHP Backdoors on WordPress Sites

A single flaw in a third-party WooCommerce plugin has sparked over 100,000 attacks, allowing hackers to upload PHP backdoors and take control of WordPress sites - a stark reminder of the importance of keeping your plugins up to date!

Analyst 207