Common RavenThreat actor
- desktop-group
- nxsms
- OPERA1ER
Threat actor Common Raven has been actively targeting financial sector institutions, compromising their SWIFT payment infrastructure to send out fraudulent payments.From MISP Galaxy
Last reported 3 years ago, by Group-IB3 reports
What the reports say
3 reports, newest first · the exact sentence from each-
Understanding Money Mules: The Hidden Link in Cybercrime“OPERA1ER’s Money Mule Scam”
-
Armés et dangereux : une soif d’argent inextinguible L’APT OPERA1ER en Afrique“Armés et dangereux : une soif d’argent inextinguible L’APT OPERA1ER en Afrique”
-
Financially motivated, dangerously activated: OPERA1ER APT in Africa“Financially motivated, dangerously activated: OPERA1ER APT in Africa”
Indicators in its reports
named in the reports above- banqueislamik.ddrive[.]onlinein 2 reports
- 52c66274994172447b21054744cc5b69in 2 reports
- files.ddrive[.]onlinein 2 reports
- 20.91.192[.]253in 2 reports
- 188.126.90[.]14in 2 reports
- 178.73.192[.]17in 2 reports
- 46.246.84[.]17in 2 reports
- 46.246.84[.]21in 2 reports
- 43.205.33[.]202in 2 reports
- 46.246.84[.]74in 2 reports
- 72.11.142[.]240in 2 reports
- 657a78dcd2c190f00b2f4ef745dd2cddin 2 reports
- 2707299e9ec7fb21…4d74865cf5a3in 2 reports
- 17e0b8fe9acfd177…f051f7e0f91fin 2 reports
- ac85af8395d1b97a…ce119e3c4955in 2 reports
Copy these 15 indicators · defanged
Thanks — we review every report.