🇫🇷

Common Raven

APT Group Financial crime ETDA ✓

Also Known As 3 names

DESKTOP-GROUP NXSMS OPERA1ER

Target Countries 14

Countries highlighted in red

Argentina Bangladesh Burkina Faso Benin Cameroon Gabon Mali Niger Nigeria Paraguay Sierra Leone Senegal Togo Uganda

Sectors Targeted

Financial Telecommunications

Details

Origin 🇫🇷 FR

Last Updated 01 Jun 2022

MITRE ATT&CK 14

T1003 T1021 T1055 T1056 T1059.001 T1071.001 T1127 T1189 T1203 T1204 T1562 T1566 T1566.001 T1569

Related Zero-Days

No zero-day CVE linked to this actor

Known Names 5 entries

OPERA1ER Group-IB

DESKTOP-GROUP c-APT-ure

Common Raven SWIFT

NXSMS Orange-CERT-CC

Bluebottle Symantec

Observed Target Countries 15

Based on ETDA data — countries highlighted in red

Argentina Bangladesh Benin Burkina Faso Cameroon Cote d'Ivoire Gabon Mali Niger Nigeria Paraguay Senegal Sierra Leone Togo Uganda

Description

(Group-IB) Digital forensics artifacts analyzed by Group-IB and Orange following more than 30 successful intrusions of OPERA1ER between 2018 and 2022 helped to trace down affected organizations in Ivory Coast, Mali, Burkina Faso, Benin, Cameroon, Bangladesh, Gabon, Niger, Nigeria, Paraguay, Senegal, Sierra Leone, Uganda, Togo, Argentina. Many of the victims identified were successfully attacked twice, and their infrastructure was then used to attack other organizations. According to Group-IB’s evaluation, between 2018 and 2022, OPERA1ER managed to steal at least $11 million, and the actual amount of damage could be as high as $30 million.

Tools Used 14

Agent Tesla BitRAT BlackNET RAT Cobalt Strike Metasploit NetWire RC Neutrino Ngrok PsExec RDPWrap RemcosRAT Revealer Keylogger VenomRAT Living off the Land

Operations 1

2022-05 Bluebottle: Campaign Hits Banks in French-speaking Countries in Africa https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/bluebottle-banks-targeted-africa

Reports & References 1

https://www.group-ib.com/media-center/press-releases/opera1er/

ETDA Profile

OPERA1ER

Origin

[Unknown]

First Seen 2016

Motivation

Financial crime

View on ETDA APT Groups ↗