VORANT. Threat Intelligence Sign in Get the full feed

Okeke Sentenced for $11M BEC Scheme

low threat manufacturing

Nigerian entrepreneur Obinwanne Okeke was sentenced to 10 years for a phishing-driven BEC scheme that stole $11 million from a London construction equipment firm.

Obinwanne Okeke, a Nigerian businessman with a public profile as a successful entrepreneur, was sentenced to 10 years in prison after pleading guilty to wire fraud in a business email compromise (BEC) scheme. In 2018, Okeke sent a phishing email to the CFO of a London-based construction equipment distributor, harvesting credentials via a spoofed login page. He used the stolen credentials to access the CFO's email account and impersonate him, directing employees to wire millions of dollars to foreign bank accounts using fraudulent invoices.

A notable technical detail in the case is Okeke's use of email filtering/forwarding rules within the compromised account to intercept and suppress any employee replies or follow-up questions that would have reached the real CFO, allowing the fraud to persist even if the CFO changed his password. The scheme resulted in $11 million in losses for the victim company. The case was investigated by the FBI's Norfolk Field Office and underscores the persistent threat BEC poses to organizations handling large financial transactions, with the FBI recommending out-of-band verification (e.g., phone calls) for high-value transfers and prompt reporting to banks and IC3 in the event of compromise.

This is a law-enforcement outcome story rather than an active-threat report; the scheme dates to 2018 and concluded with sentencing in February 2021. It illustrates common BEC tradecraft — credential phishing, email account takeover, mailbox rule manipulation, and social engineering via fraudulent wire instructions — rather than introducing new malware or infrastructure.

Mentioned in this report

Threat actors Obinwanne Okeke

Detection guidance

Suspicious Inbox Rule Created to Hide or Delete Replies (BEC Evasion)

ATT&CK T1114.003

Detects creation/modification of a mailbox inbox rule that automatically deletes, moves, or forwards messages matching reply-related keywords (e.g. RE:, invoice, payment), a pattern used by BEC actors to suppress victim replies after account takeover. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Suspicious Inbox Rule Created to Hide or Delete Replies
id: b5e35965-244d-5686-a69a-02d959f4eee8
status: experimental
description: 'Detects creation or modification of a mailbox inbox rule (New-InboxRule
  / Set-InboxRule) that

  deletes, moves to a hidden folder, or forwards messages containing reply/invoice/payment
  related

  keywords. This is a common BEC post-compromise technique used to suppress replies
  from the real

  account owner or from employees questioning fraudulent wire instructions, allowing
  the fraud to

  continue even after a password reset.

  '
references:
- https://www.justice.gov/usao-edva/pr/nigerian-man-sentenced-11-million-business-email-compromise-scheme
author: Vorant
tags:
- attack.T1114.003
- attack.collection
logsource:
  product: m365
  service: threat_management
detection:
  selection_op:
    Operation:
    - New-InboxRule
    - Set-InboxRule
  selection_action:
    Parameters|contains:
    - DeleteMessage
    - MoveToFolder
    - ForwardTo
    - ForwardAsAttachmentTo
    - RedirectTo
  selection_keyword:
    Parameters|contains:
    - SubjectContainsWords
    - BodyContainsWords
    - invoice
    - payment
    - wire
    - 'RE:'
  condition: selection_op and selection_action and selection_keyword
falsepositives:
- Legitimate helpdesk or admin-created rules that archive/move newsletters or automated
  notification threads containing similar keywords
- User-created rules to organize invoice/payment related email into folders (should
  still be reviewed if combined with delete/forward)
level: high

Mailbox Auto-Forwarding to External SMTP Address Enabled

ATT&CK T1114.003

Detects configuration of mailbox-level auto-forwarding (ForwardingSmtpAddress/ForwardingAddress) to an external address, a technique used after email account takeover to exfiltrate or intercept mail such as employee replies to fraudulent wire instructions. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Mailbox Auto-Forwarding to External Address Configured
id: eec51ee5-26d0-522a-acaf-a04a027d9fd2
status: experimental
description: 'Detects use of Set-Mailbox to configure ForwardingSmtpAddress or ForwardingAddress,
  enabling

  silent auto-forwarding of all mail out of a compromised mailbox. Attackers in BEC
  operations use

  this to continue receiving copies of correspondence (or suppress visibility to the
  real owner)

  after account takeover via phishing.

  '
references:
- https://www.justice.gov/usao-edva/pr/nigerian-man-sentenced-11-million-business-email-compromise-scheme
author: Vorant
tags:
- attack.T1114.003
- attack.collection
logsource:
  product: m365
  service: threat_management
detection:
  selection:
    Operation: Set-Mailbox
    Parameters|contains:
    - ForwardingSmtpAddress
    - ForwardingAddress
  filter_internal_domain:
    Parameters|contains:
    - onmicrosoft.com
  condition: selection and not filter_internal_domain
falsepositives:
- IT-approved mailbox migrations or forwarding to a sanctioned partner/vendor domain
- Legitimate shared-mailbox forwarding configured by administrators during tenant-to-tenant
  moves
level: high

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.fbi.gov/news/stories/international-scammer-sentenced-for-phishing-bec-scheme-042621

This is the public brief

Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.

Start free