Full Report
En 2019, l'équipe Threat Intelligence de Group-IB a détecté une série d'attaques ciblant des organisations financières en Afrique.
Analysis Summary
# Threat Actor: OPERA1ER
## Attribution & Identity
**OPERA1ER** (also known by the report title "Playing God without permission") is a financially motivated threat actor group. While specific individual identities are not disclosed in the provided text, Group-IB's Threat Intelligence team has tracked them since 2019, specifically focusing on their activities targeting the French-speaking African financial sector.
## Activity Summary
The actor is known for conducting high-stakes campaigns against financial organizations and service providers. The provided report highlights a 2019 series of attacks and subsequent infrastructure tracking. OPERA1ER is characterized by a patient, methodical approach, often remaining within a network for extended periods to understand internal processes before executing a final theft.
## Tactics, Techniques & Procedures
The actor utilizes a mix of commodity malware and professional red-teaming frameworks to maintain persistence and move laterally.
- **Infrastructure Tracking:** Use of specific Cobalt Strike PublicKeys for C2 identification.
- **Persistence & Lateral Movement:** Deployment of Cobalt Strike Beacons.
- **Remote Access:** Use of BitRAT for host control.
- **Anonymization:** Extensive use of VPN infrastructures (e.g., FrootVPN) and Dynamic DNS (DynDNS) to mask the origin of their operations.
- **Network Scanning/Listener Config:** Use of Cobalt Strike listeners specifically on port 777.
- **Stealth:** Use of specific SSH fingerprints (*657a78dcd2c190f00b2f4ef745dd2cdd*) to manage backend infrastructure.
**MITRE ATT&CK IDs (Inferred from text):**
- **T1583.003:** Acquire Infrastructure: DNS Server (DynDNS)
- **T1573:** Encrypted Channel (SSH/Cobalt Strike)
- **T1071.001:** Application Layer Protocol: Web Protocols (Cobalt Strike C2)
- **T1219:** Remote Access Software (BitRAT)
## Targeting
- **Sectors:** Financial services, banking, and telecommunications.
- **Geography:** Primarily Africa (specifically French-speaking regions).
- **Victims:** Financial institutions; the domain `banqueislamik[.]ddrive[.]online` suggests targeting or impersonation of Islamic banking entities.
## Tools & Infrastructure
- **Malware Families:**
- Cobalt Strike (Beacons)
- BitRAT
- **Infrastructure:**
- **C2 Domains:**
- files[.]ddrive[.]online
- banqueislamik[.]ddrive[.]online
- **IP Addresses (Defanged):**
- 20[.]91[.]192[.]253
- 188[.]126[.]90[.]14
- 178[.]73[.]192[.]17
- 46[.]246[.]84[.]17
- 46[.]246[.]84[.]21
- 43[.]205[.]33[.]202
- 46[.]246[.]84[.]74
- 72[.]11[.]142[.]240
- **VPN Providers:** FrootVPN
## Implications
OPERA1ER represents a significant threat to the African financial ecosystem. Their ability to manage complex infrastructure and utilize professional-grade tools like Cobalt Strike indicates a high level of operational maturity. Their focus on regional banks suggests they exploit potential gaps in cybersecurity maturity in developing markets to conduct large-scale financial theft.
## Mitigations
- **Network Monitoring:** Implement detections for Cobalt Strike traffic, specifically monitoring for the unique PublicKey fingerprints and non-standard ports (e.g., Port 777).
- **Traffic Analysis:** Monitor and restrict outbound connections to known Dynamic DNS providers and commercial VPN services like FrootVPN from sensitive internal servers.
- **Endpoint Security:** Deploy EDR solutions capable of detecting BitRAT and unauthorized Cobalt Strike beacon activity.
- **SSH Hardening:** Audit SSH logs for the specific fingerprints identified in the report and restrict SSH access to known, authorized administrative IPs.