HOMETHREATSScattered Canary
APT / THREAT GROUP

Scattered Canary

🇳🇬Nigeria-attributed
1
campaigns
1
aliases
Last seen:Mar 17, 2026

Intelligence Profile

When the first member of Scattered Canary, who, for the purposes of this report, we call

Alpha, began his operations, he was a lone wolf—working mostly Craigslist scams as he learned

the tricks of the trade from a mentor. However, within a few years, he had honed his craft

enough to expand into romance scams, where he met his first “employee,” Beta. Once they

had secured enough mules via their romance scams to launder their stolen money, they shifted

from targeting individuals to targeting enterprises, and the group’s BEC operation was born.

Threat Analysis

Scattered Canary is a known-sophistication threat actor attributed to Nigeria, engaged in cyber operations with a primary motivation of unknown activity patterns.

Known Campaigns

Scattered Canary — Active Operations March 2026

Scattered Canary is a unknown-motivation threat actor attributed to NG. When the first member of Scattered Canary, who, for the purposes of this report, we call Alpha, began his operations, he was a lone wolf—working mostly Craigslist scams as he learned the tricks of the trade from a mentor. However, within a few years, he had honed his craft enough...

ACTIVEMEDIUM2026

External References

Quick Facts

TypeAPT / Threat Group
Origin🇳🇬 Nigeria
Aliases1
SourceMalpedia

Also Known As

Scattered Canary

Research Links

Data sourced from Malpedia, Ransomware.live, RansomLook, and CTIWATCH OSINT collection. Actor attribution is based on available intelligence and may be incomplete.