After a year-long investigation conducted with the assistance of Interpol, Nigerian authorities arrested the suspected leader of the SilverTerrier threat organization in March 2022. SilverTerrier primarily targets entities throughout the technology, education, and manufacturing industries and has been active in the threat landscape since 2014. The operation, dubbed Operation Delilah by authorities, was assisted by intelligence from the private sector, including Trend Micro, Palo Alto, and Group-IB. According to security researchers from Unit 42, the SilverTerrier leader was involved in the creation of over 200 domains, some of which are command-and-control (C2) nodes for the group’s malicious payloads, including LokiBot. The arrest of SilverTerrier’s leader is the third in a series of law enforcement actions against the group. In November 2020, three (3) SilverTerrier-connected threat actors were arrested by Nigerian authorities and charged with a series of schemes that ultimately impacted over 500,000 entities across 150 countries since 2017. In December 2021, eleven (11) additional threat actors, six (6) of whom were believed to be part of SilverTerrier, were arrested in an operation dubbed Operation Falcon. Specific charges against the group’s leader have not yet been disclosed by authorities, however CTIX continues to track the operation and will provide additional insight once more information is released by authorities.