Sunu Bank

Summary

During a system migration, cybercriminals infiltrated BICIS and debited an estimated 211 million CFA francs from client accounts including pharmacies and notary offices. The suspects transferred the money, converted it to USDT, and paid intermediaries per transaction while authorities arrested Modou Diom, Sunday Akamibé and Khadim Khouma, seizing cash and cocaine. Investigators pursue additional recipients and have charged the group with criminal association, theft, concealment, exchange violations, drug trafficking and money laundering.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

On April 7, 2025, the International Bank for Commerce and Industry of Senegal (BICIS), which had recently been acquired by the Sunu group, was in the process of migrating from its legacy Connexis application to the new My Sunu Corporation platform. During this migration window, cybercriminals gained unauthorized access to the bank’s systems and initiated fraudulent debits that totaled an estimated 211 million CFA francs from the accounts of various clients, including pharmacies and notary offices. The bank’s security team traced the flow of the illicit funds to specific recipient accounts, which led the Dakar Research Section (SR) to locate and arrest Modou Diom, the collection agent for Bamba Global Industrie Suarl, in the Sicap Foire district. In his initial interrogation, Modou Diom stated that a Nigerian national identified as Sunday Akamibé had solicited him for bank account numbers to facilitate transfers, and that he had provided the account details of D. Gaye, who later voluntarily presented himself to the SR, as well as the two account numbers belonging to his employer, Khadim Khouma. Modou Diom further explained that once the fraudulent proceeds were available, Sunday Akamibé instructed him to convert the amounts into the cryptocurrency USDT and to transfer the equivalent value to a designated wallet, for which he received a payment of 300,000 CFA francs per transaction.

Khadim Khouma, the manager of Bamba Global Industrie Suarl and Modou Diom’s employer, told investigators that Modou Diom had approached him claiming a client needed his account number for a transfer, prompting him to provide his bank details and subsequently receive two separate transfers amounting to 35 million CFA francs. After the funds arrived, Khadim Khouma said Modou Diom asked him to convert the money into USDT using an account that Modou Diom had supplied, a request he fulfilled without knowing the illicit origin of the money. Khadim Khouma insisted he had no prior acquaintance with Sunday Akamibé and was unaware that the funds stemmed from the BICIS breach, although the subsequent gendarmerie investigation revealed he lacked any legal authorization to conduct currency exchange or cryptocurrency conversion activities within Senegal, exposing him to potential tax evasion liabilities. While pursuing Sunday Akamibé, who remained at large, SR agents searched his office and uncovered 10.684 million CFA francs in cash alongside 36 cocaine pellets. Following these findings, Khadim Khouma was arrested at his residence, where he reiterated that Modou Diom had described the transfers as a client request and confirmed that eleven additional beneficiaries of the fraudulent transactions—including merchants and money‑transfer operators—were still being sought by authorities.

The financial prosecutor, who assumed responsibility for the case, formally requested that the judge of the third financial chamber open a judicial investigation covering charges of criminal association, complicity in theft by fraudulent entry into a computer system, concealment, violation of exchange regulations, possession and international drug trafficking, and money laundering. According to the Libération report cited in the article, the two primary suspects, Modou Diom and Sunday Akamibé, were awaiting a determination of their legal status after the case was returned to the prosecutor’s office for further proceedings. No additional details about sentencing or case resolution were provided in the source material.

Sources

Sources available to members: 1 source.