Actor Profile

Black Axe and associated West African organized crime groups are transnational criminal networks responsible for a significant share of global cyber-enabled financial fraud. These groups operate across six continents, leveraging crime-as-a-service (CaaS) infrastructure to conduct romance scams, cryptocurrency and investment fraud, and business email compromise (BEC) operations. The networks function with organizational structures resembling legitimate businesses, assigning specialized roles such as "conversion" and "retention" agents to optimize fraud operations. Beyond cyber fraud, these groups are also linked to other serious and violent crimes. Their operations rely on sophisticated money laundering networks using shell companies, remittance services, and multiple financial instruments to obscure illicit fund origins.

TTPs (Tactics, Techniques, Procedures)

T1566 (Phishing) - Romance scams and social engineering to establish victim trust; T1534 (Internal Spying) - Business email compromise fraud targeting corporate financial systems; T1573 (Encrypted Channel) - Cryptocurrency wallets and blockchain-based fund transfers; T1027 (Obfuscated Files or Information) - Shell companies and remittance services to obscure fund origins; T1078 (Valid Accounts) - Exploitation of legitimate financial instruments across 560 transactions in single money laundering operation; T1486 (Data Encrypted for Impact) - Investment scams promising high returns in stocks and cryptocurrency; T1071 (Application Layer Protocol) - Call center operations for sophisticated investment fraud schemes.

Targets & Patterns

West African organized crime groups primarily target financial services sectors and individual victims across English-speaking countries, with particular focus on retirees vulnerable to romance and investment scams. The groups operate globally across six continents, with documented activity in 22 countries including Austria, Argentina, Australia, Canada, France, Germany, Indonesia, Ireland, Italy, Japan, Malaysia, Netherlands, Nigeria, Portugal, South Africa, Spain, Sweden, Switzerland, UAE, UK, and US. Targeting patterns show preference for high-value victims in developed economies, with one Romanian-based operation alone stealing an estimated €143 million ($166 million). The selection of retirees as targets suggests deliberate victim profiling based on accumulated wealth and potentially lower technical sophistication. Geographic distribution indicates these networks exploit international jurisdictional complexities to evade law enforcement.

Historical Context

Operation Jackal IV represents the fourth iteration of INTERPOL's coordinated campaign against West African financial crime networks, demonstrating escalating scale and sophistication. Operation Jackal I (September 2022) resulted in 75 arrests and €1.2 million intercepted. Operation Jackal II (May 2023) expanded to 103 arrests, 1,110 suspects identified, and €2.15 million seized. Operation Jackal III (April-July 2024) marked significant escalation with 300 arrests, 400 suspects identified, and over 720 bank accounts blocked. Operation Jackal IV (November 2025-June 2026) identified 263 suspects and arrested 58 individuals, with notable disruption of a 196-person crime-as-a-service network providing infrastructure support. The progression shows increasing international cooperation (22 countries in Jackal IV) and focus on dismantling enabling infrastructure rather than just arresting individual operators. Financial impact has grown substantially, with the Romanian investment scam alone representing €143 million in losses.

Defensive Recommendations

  • Monitor for romance scam indicators including rapid relationship progression, requests for financial assistance, and cryptocurrency payment requests targeting customer accounts, particularly those belonging to retirees
  • Implement enhanced transaction monitoring for business email compromise patterns, including unusual wire transfer requests, vendor payment changes, and executive impersonation attempts
  • Deploy behavioral analytics to detect money laundering patterns such as rapid fund movement across multiple accounts, use of shell companies, and high-volume low-value transactions (e.g., 560 transactions across 20 financial instruments)
  • Establish cross-border information sharing protocols with financial intelligence units to track illicit cryptocurrency flows and identify wallet addresses associated with West African fraud networks
  • Conduct employee and customer awareness training focused on investment scams promising unrealistic returns in stocks and cryptocurrency, emphasizing verification of investment platforms and regulatory registration

---

# Geopolitical Context

Geopolitical Context

Operation Jackal IV represents a sustained multilateral law enforcement response to the transnational threat posed by West African organized crime groups, particularly those originating from Nigeria and operating across six continents. These networks—including Black Axe and similar syndicates—have evolved into sophisticated crime-as-a-service ecosystems that exploit global financial infrastructure through romance scams, business email compromise, and cryptocurrency fraud. The operation's scale (22 countries, eight months) reflects growing recognition among Western and allied law enforcement agencies that West African cybercrime groups represent a persistent, organized threat requiring coordinated disruption rather than isolated national responses. The involvement of major economies (U.S., U.K., Germany, France, Japan, Australia) alongside regional partners (Nigeria, Côte d'Ivoire, South Africa) signals a strategic prioritization of financial crime networks that undermine trust in digital commerce and disproportionately target vulnerable populations in English-speaking developed nations.

State Actor Alignment

While the criminal networks targeted are non-state actors, their operational bases in West Africa—particularly Nigeria and South Africa—place them within jurisdictions where state capacity to combat organized cybercrime has historically been limited. Nigeria's participation in Operation Jackal IV is consistent with its evolving posture under international pressure to address cybercrime emanating from its territory, particularly following its removal from the Financial Action Task Force (FATF) grey list considerations. South Africa's role as both a participant and a primary operational theater (39 arrests in Johannesburg) underscores its dual status as a regional financial hub and a staging ground for transnational fraud operations. The operation does not appear to involve state-sponsored actors, but the crime-as-a-service infrastructure identified—providing domains and money laundering support—suggests a level of organizational sophistication that may benefit from corruption or regulatory gaps in certain jurisdictions. No sanctions regimes are directly implicated, though the financial flows intercepted (€845,000 laundered through shell companies and remittance services) align with patterns targeted by anti-money laundering frameworks under FATF and EU directives.

Business Impacty pro region

For Europe, Operation Jackal IV addresses a growing vulnerability: the targeting of aging populations through romance and investment scams, with significant operations dismantled in Romania (€143 million stolen) and across multiple EU member states. The pan-European money laundering network identified demonstrates how West African groups exploit the EU's integrated financial system and freedom of movement to obscure illicit proceeds. The operation's success in blocking 257 bank accounts in South Africa and seizing assets across multiple jurisdictions may temporarily disrupt cash flows, but the recurrence of Jackal operations (four iterations since 2022) suggests these networks reconstitute rapidly. For Africa, the operation highlights the reputational and economic costs of hosting cybercrime infrastructure, particularly for Nigeria and South Africa, which seek foreign investment and financial integration. The identification of 196 individuals linked to a crime-as-a-service network indicates a maturing criminal ecosystem that mirrors legitimate tech industry structures. For Asia-Pacific participants (Japan, Malaysia, Indonesia, Australia), involvement reflects concern over cryptocurrency fraud vectors and the region's role as both a victim pool and a money laundering corridor. North American and European financial institutions remain primary targets, with business email compromise and investment scams exploiting trust in Western regulatory environments.

Forecast

If West African organized crime groups continue to adapt their tactics—particularly through decentralized crime-as-a-service models and cryptocurrency obfuscation—law enforcement agencies are likely to pursue additional Jackal-style operations with increasing focus on financial intelligence and asset seizure rather than arrests alone. If Nigeria and South Africa enhance domestic enforcement capacity and regulatory oversight of fintech and remittance sectors, the operational environment for these networks may become more constrained, though displacement to other jurisdictions with weaker governance is probable. If European and North American authorities expand public-private partnerships with financial institutions and cryptocurrency exchanges, detection and interdiction of fraudulent transactions may improve, potentially reducing victim losses. However, if the underlying socioeconomic conditions in West Africa—youth unemployment, limited economic opportunity—remain unaddressed, recruitment into cybercrime networks is likely to persist, ensuring a steady supply of operatives despite periodic disruptions. The four-iteration pattern of Operation Jackal suggests INTERPOL views this as a long-term campaign requiring sustained international coordination rather than a finite problem set.