A suspected executive of a French-speaking hacking group known as OPERA1ER has been arrested as part of an international law enforcement operation codenamed Nellborn, Interpol said.
“The group is believed to have stolen an estimated $11 million and in some cases as much as $30 million in more than 30 attacks across 15 countries in Africa, Asia and Latin America,” officials said. .
The arrest was made by Ivory Coast authorities early last month. Additional insights were provided by the U.S. Secret Intelligence Service’s Criminal Investigations Division and the Booz Allen Hamilton Dark Lab.
This financial group is also known as Common Raven, DESKTOP-GROUP, and NX$M$. The modus operandi was first exposed by Group-IB and the Orange CERT Coordination Center (Orange-CERT-CC) in November 2022, and was used to compromise banks, financial services, and telecommunications companies from March 2018 to October 2022. details have been revealed.
🔐 Privileged Access Management: Learn How to Overcome Key Challenges
Discover different approaches to overcoming the challenges of privileged account management (PAM) and leveling up your privileged access security strategy.
reserve a spot
Earlier this year, Broadcom-owned Symantec announced that it had uncovered a series of targeted attacks against the financial sector of French-speaking African countries from at least July 2022 to September 2022. The company said there is some cross-cutting in this activity, which it tracks as bluebottle. With OPERA1ER.
The attack chain set up by this group uses the lure of spear phishing to trigger a series of events that eventually lead to post-exploit tools such as Cobalt Strike and Metasploit, as well as off-the-shelf remote access trojans with various capabilities. It leads to the deployment of a wooden horse. Steal confidential data.
OPERA1ER has been observed to maintain access to compromised networks for 3 to 12 months, sometimes targeting the same company multiple times.
“Most of the messages were written in French and mimicked fake tax notices and employment offers,” Group-IB said. “OPERA1ER was able to access the internal payment system used by the affected organization and used it to withdraw funds.”
