The security company Check Point said among the companies that the man had managed to infect were:

• a marine and energy solutions company in Croatia;
• a transportation company in Abu Dhabi;
• a mining company in Egypt;
• a construction company in Dubai;
• an oil and gas firm in Kuwait; and
• a construction organisation in Germany.

While the initial expectation was that a number of people would be needed to stage this many attacks, Check Point said its researchers had finally tracked the attacks down to a Nigerian who was working on his own.

The man, who was located close to the Nigerian capital Abuja, had the following motto on his social media accounts: "Get rich or die trying".

Check Point said the man used bogus emails which appeared to originate from the Saudi Arabian oil giant, Saudi Aramco. His targets were staff on the financial side of companies, trying to trick them into revealing company bank details or else to open the malware attachment in the email. 

He was found to be using a remote access trojan known as Netwire which allows an attacked to have full control over infected machines, and a key-logging tool known as Hawkeye.

The attacks were launched from two Yahoo! email addresses:  sale.cement_till_tw@yahoo.com, and cciticarinternational@yahoo.com.

"What’s more, the malware he uses is old, generic and readily available online and he uses freeware to ‘scrape’ email addresses from corporate websites which he then uses as targets for his campaigns," the Check Point researchers said.

"The fact that the campaign was still effective, despite using only basic cyber-criminal techniques, highlights just how much of a problem these business email compromise attacks have become."

Check Point said it had informed authorities in Nigeria about its findings.