A French-speaking threat actor dubbed OPERA1ER has been linked to a series of more than 30 successful cyber attacks aimed at banks, financial services, and telecom companies across Africa, Asia, and Latin America between 2018 and 2022.
According to Singapore-headquartered cybersecurity company Group-IB, the attacks have led to thefts totaling $11 million, with actual damages estimated to be as high as $30 million.
Some of the more recent attacks in 2021 and 2021 have singled out five different banks in Burkina Faso, Benin, Ivory Coast, and Senegal. Many of the victims identified are said to have been compromised twice, and their infrastructure subsequently weaponized to strike other organizations.
OPERA1ER, also called by the names DESKTOP-GROUP, Common Raven, and NXSMS, is known to be active since 2016, operating with the goal of conducting financially motivated heists and exfiltration of documents for further use in spear-phishing attacks.
“OPERA1ER often operates during weekends and public holidays,” Group-IB said in a report shared with The Hacker News, adding the adversary’s “entire arsenal is based on open-source programs and trojans, or free published RATs that can be found on the dark web.”
This includes off-the-shelf malware such as Nanocore, Netwire, Agent Teslam Venom RAT, BitRAT, Metasploit, and Cobalt Strike Beacon, among others.
The attack chain commences with “high-quality spear-phishing emails” bearing invoice, delivery, and hiring-themed lures written primarily in French and to a lesser extent in English. Some of the bogus missives used specific topics about transferring digital money between mobile operators and banks.
Read more: thehackernews.com
