BlueBottle

APT Group ETDA ✓

Also Known As

No alias recorded

Target Countries

No target country recorded

Sectors Targeted

No targeted sector recorded

Details

Origin Unknown

Last Updated 08 Nov 2023

MITRE ATT&CK 4

T1059.003 T1071.001 T1078 T1566.001

Related Zero-Days

No zero-day CVE linked to this actor

Known Names 5 entries

OPERA1ER Group-IB

DESKTOP-GROUP c-APT-ure

Common Raven SWIFT

NXSMS Orange-CERT-CC

Bluebottle Symantec

Observed Target Countries 15

Based on ETDA data — countries highlighted in red

Argentina Bangladesh Benin Burkina Faso Cameroon Cote d'Ivoire Gabon Mali Niger Nigeria Paraguay Senegal Sierra Leone Togo Uganda

Description

(Group-IB) Digital forensics artifacts analyzed by Group-IB and Orange following more than 30 successful intrusions of OPERA1ER between 2018 and 2022 helped to trace down affected organizations in Ivory Coast, Mali, Burkina Faso, Benin, Cameroon, Bangladesh, Gabon, Niger, Nigeria, Paraguay, Senegal, Sierra Leone, Uganda, Togo, Argentina. Many of the victims identified were successfully attacked twice, and their infrastructure was then used to attack other organizations. According to Group-IB’s evaluation, between 2018 and 2022, OPERA1ER managed to steal at least $11 million, and the actual amount of damage could be as high as $30 million.

Tools Used 14

Agent Tesla BitRAT BlackNET RAT Cobalt Strike Metasploit NetWire RC Neutrino Ngrok PsExec RDPWrap RemcosRAT Revealer Keylogger VenomRAT Living off the Land

Operations 1

2022-05 Bluebottle: Campaign Hits Banks in French-speaking Countries in Africa https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/bluebottle-banks-targeted-africa

Reports & References 1

https://www.group-ib.com/media-center/press-releases/opera1er/

ETDA Profile

OPERA1ER

Origin

[Unknown]

First Seen 2016

Motivation

Financial crime

View on ETDA APT Groups ↗