Financially motivated, dangerously activated: OPERA1ER APT in Africa

guest · Jan 5, 2023

Bluebottle hackers used signed Windows driver in attacks on banks
By Ionut Ilascu @Ionut_Ilascu - January 5, 2023

A signed Windows driver has been used in attacks on banks in French-speaking countries, likely from a threat actor that stole more than $11 million from various banks.
The activity and targets fit the profile of the OPERA1ER hackers that have been attributed at least 35 successful attacks between 2018 and 2020.

The gang is believed to have French-speaking members and to operate from Africa, targeting organizations in the region, although they also hit companies in Argentina, Paraguay, and Bangladesh.
Click to expand...

Bluebottle TTPs point to OPERA1ER
In a report today, researchers at Symantec, a division of Broadcom Software, reveal details about the activity of a cybercriminal group they track as Bluebottle that shares significant similarities with the OPERA1ER gang’s tactics, techniques, and procedures (TTPs).

OPERA1ER’s campaigns have been documented by cybersecurity company Group-IB in a lengthy report published in early November 2022, where researchers note the lack of custom malware and the extensive use of readily available tools (open source, commodity, frameworks).
Click to expand...

It appears that the signed malicious driver has been used by multiple cybercriminal groups to disable defense. Mandiant and Sophos reported it in mid-December in a list that included kernel-mode drivers verified with Authenticode signatures from Microsoft's Windows Hardware Developer Program.

The recent attacks show some new TTPs, as well, which include the use of GuLoader in the initial stages of the attack. Additionally, the researchers saw indications that the threat actor used ISO disk images as an initial infection vector in job-themed spear-phishing.

“However, the job-themed malware in July was observed in paths suggesting it had been mounted as CD-ROMs. This could indicate a genuine disc was inserted, but it could also be that a malicious ISO file was delivered to victims and mounted” - Symantec
Click to expand...

While the analysis of the attacks and the tools used suggest that OPERA1ER and Bluebottle are the same group, Symantec cannot confirm that the activity they saw had the same monetization success as reported by Group-IB.
Click to expand...

Symantec: Bluebottle: Campaign Hits Banks in French-speaking Countries in Africa

January 5, 2023
Continuation of previously documented activity leverages new TTPs.
Bluebottle, a cyber-crime group that specializes in targeted attacks against the financial sector, is continuing to mount attacks on banks in Francophone countries. The group makes extensive use of living off the land, dual-use tools, and commodity malware, with no custom malware deployed in this campaign.
Click to expand...

Use of a signed driver to kill processes
A set of malware was also deployed by the attackers that had the likely goal of disabling the security products on victim networks. The malware consisted of two components, a controlling DLL that reads a list of processes from a third file, and a signed 'helper' driver controlled by the first driver and used to terminate the processes in the list.
Click to expand...

Log in or Sign up

Financially motivated, dangerously activated: OPERA1ER APT in Africa

guest Guest

Log in or Sign up

Financially motivated, dangerously activated: OPERA1ER APT in Africa

guest Guest

Useful Searches