The enduring cultural image of the cybercriminal is an unexpectedly persistent myth. For a long time now, pop culture has depicted the threat adversary as a lone, anti-social hacker operating from a dark bedroom, driven by mischief or vague ideological grievances.
By Richard Ford, group chief technology officer at Integrity360
That archetype is very much removed from reality. Today, when an organisation falls victim to a cyberattack, it is not battling an individual – it is defending itself against a highly structured, multinational corporation.
Modern cybercrime syndicates aren’t chaotic networks of amateurs. They have matured into sophisticated enterprises led by individuals with genuine corporate experience. These leaders apply standard business management principles, operational hierarchies, and advanced technologies (and even offer paid leave to new recruits) to maximise their return on investment. If your security team is still defending against the hacker of the 1990s, they are woefully underestimating the adversary.
The corporate structure of a cyber cartel
To understand the scale of this challenge, one must look at how these criminal groups are structured. They do not operate in silos; they mirror the exact department blocks of the organisations they target. Synergy is effective in business, whether legitimate or illicit. These cartels are governed by executive boards – sometimes referred to in intelligence circles as the Council of Elders or the Council of Professors. Beneath this C-suite sits a highly specialised division of labour:
- Human Resources: Tasked with recruiting developers, translators, and social engineering specialists, often offering competitive salaries, performance-based bonuses, and even structured leave.
- Finance and Payroll: Managing the complex flow of digital currencies, laundering profits, and ensuring that syndicate members and affiliates are paid on time.
- Technical and DevOps: Building and maintaining malicious software, setting up infrastructure, and testing malware against common security systems to ensure bypass capabilities.
- Operations and Customer Support: Running the day-to-day campaign mechanics and, remarkably, even operating helpdesks to assist victims with purchasing cryptocurrency to pay ransoms in many instances.
By treating cybercrime as an industrial enterprise, these groups have achieved unprecedented scale. They run performance metrics, track target success rates, and optimise their campaigns using data-driven insights. They are, in every measurable way, your organisation’s dark mirror.
Inside the trust engine of modern fraud
The business-like nature of these syndicates is most visible in how they manage their “customers” – the victims. Large-scale fraud campaigns, such as sophisticated investment scams, are managed using customer relationship management (CRM) platforms that would look entirely familiar to a legitimate sales team.
These cartels meticulously track their leads through a structured sales funnel. When a victim is lured into a fraudulent investment scheme, they are not immediately cleaned out. Instead, they are introduced to a highly polished user experience. Syndicates have been known to build realistic dashboards that display fabricated, steadily growing profits. To cement this illusion of legitimacy, the syndicate will often allow the victim to make small, early withdrawals of their “earnings”. This tactic, designed to build unearned trust, encourages the victim to invest significantly larger sums that can eventually financially ruin many victims.
Crucially, the deception goes deeper. In recent campaigns, syndicates have begun requesting Know Your Customer (KYC) documentation, including identity books and proof of address, under the guise of regulatory compliance. This is a brilliant and alarming psychological trick: it exploits the victim’s natural compliance habits. By demanding KYC documents, the criminals make the platform feel safe and legitimate, while simultaneously harvesting high-value personal data for secondary identity theft and deeper network intrusion.
AI as a local force multiplier
Historically, global cybercrime syndicates were hampered by language and cultural barriers. Phishing emails and fraudulent websites were often easy to spot due to poor grammar, awkward phrasing, or generic templates.
Artificial intelligence (AI) has completely erased these friction points. Generative AI allows non-English-speaking syndicates to produce flawless, culturally nuanced communications in any language. This capability has democratised high-end social engineering, enabling mid-tier criminals to execute highly sophisticated campaigns across multiple regions with minimal operational cost.
In South Africa, this trend has manifested in highly targeted, localised deepfake campaigns. Syndicates are now using AI to clone the voices and faces of local media personalities, business leaders, and even the national rugby captain to promote fraudulent investment applications. These deepfakes are distributed via social media advertising, leveraging the established trust of public figures to bypass the natural scepticism of local targets.
When an adversary can generate localised, high-fidelity audio and video assets in minutes, the traditional advice of “looking out for spelling mistakes” just doesn’t cut it as a viable defence anymore.
Breaking down defensive silos
If the adversaries are operating as a highly integrated corporate machine, defensive strategies must adapt. The current defensive posture of many South African organisations can in many cases be worryingly fragmented.
Too often, internal departments operate in isolation. The cybersecurity team manages network defences, the fraud division handles transactional anomalies, and the legal and governance teams manage compliance. This lack of cohesion is exactly what organised syndicates exploit. A technical anomaly detected by the IT team might be the exact precursor to a social engineering campaign targeting the finance department, yet the two teams aren’t always able to share intelligence in real time.
Organisations must transition from reactive monitoring to proactive, unified defence. This requires breaking down internal barriers and establishing collaborative incident response structures that bridge the gap between technical security and fraud prevention. Furthermore, employee awareness programmes must evolve. Standard compliance training that teaches workers to tick boxes is failing. Defence requires building an organisational culture where employees understand the psychological tactics used by syndicates – such as the manufactured urgency of a fake executive instruction or the false legitimacy of an unexpected KYC request.
The threat we face can’t simply be solved by the IT department. It is an organised, well-funded, and highly strategic business competitor. Defeating a corporate adversary requires organisations to start operating with the same level of integration, agility, and strategic focus as the threat actors they face – a level that can be uncomfortably high and too often misunderstood.