Cyber Threat Actor: Modou Diom

Modou Diom is a threat actor operating in Senegal, implicated in a financially motivated cyberattack against a Senegalese bank during its migration to a new digital platform in April 2025. The operation resulted in unauthorized transfers totaling approximately 211 million CFA francs from client accounts, including those of pharmacies and notary offices. Diom, identified as a collection agent, collaborated with Nigerian national Sunday Akamibé, who remains at large, to orchestrate the theft. Investigators arrested Diom alongside Khadim Khouma, an accomplice operating unauthorized currency exchange services used to launder stolen funds by converting them into USDT cryptocurrency. The group exploited vulnerabilities during the bank’s transitional phase to infiltrate systems, indicating opportunistic targeting of financial institutions during periods of operational change.

The threat actor’s tactics involved leveraging the bank’s migration process as an initial access vector, followed by funneling stolen funds through a network of accomplices for cryptocurrency conversion. While specific malware or tooling remains unspecified, the operation demonstrated coordination with criminal associates specializing in money laundering and illicit currency exchanges. Public attribution links Diom to a criminal consortium rather than state-sponsored activity, with Khouma’s involvement highlighting ties to underground financial networks. Searches during the investigation uncovered additional illegal activities, including cocaine possession and potential tax evasion, leading prosecutors to pursue charges spanning computer fraud, money laundering, criminal association, and international drug trafficking. The case underscores the convergence of cybercrime with traditional illicit economies in the region, though the full scope of the group’s operations remains under investigation with multiple suspects still sought.