Operation Nervone Disrupts OPERA1ER Cybercrime Group, Key Member Arrested
Summary
An international investigation involving Group-IB, Orange-CERT-CC, and law enforcement helped disrupt OPERA1ER, a group that targeted financial institutions with phishing, credential theft, and fraudulent transactions. INTERPOL announced a key member’s arrest in Côte dʼ
Key points
- OPERA1ER targeted banks, financial institutions, telecom providers, and mobile money services across Africa, as well as South Asia and Latin America.
- The group used spear-phishing emails with malicious links or attachments to deploy remote access trojans and password sniffers.
- After gaining access, attackers stole credentials, escalated privileges, moved laterally, and compromised banking and payment systems to conduct fraud.
- Investigators linked the group’s infrastructure and members using domain-registration data, WHOIS records, SSL certificates, and online accounts.
- Intelligence sharing between Group-IB, Orange-CERT-CC, INTERPOL, AFRIPOL, and Côte d’Ivoire’s DITT supported Operation Nervone.
- INTERPOL announced in July 2023 that a key OPERA1ER member had been arrested in Côte d’Ivoire.
Article Details
- Event Type
- Multinational law-enforcement operation that disrupted OPERA1ER, a financially motivated cybercrime syndicate, and led to the arrest of a key member.
- Impact
- The investigation and intelligence sharing by Group-IB, Orange-CERT-CC, and INTERPOL supported coordinated action involving AFRIPOL, INTERPOL, and DITT. A key OPERA1ER member was arrested in Côte d’Ivoire in July 2023, weakening the group’s ability to conduct large-scale fraud.
People
Threat Actors
Common RavenName the source says OPERA1ER was also known by.DESKTOP-GROUPName the source says OPERA1ER was also known by.NXSMSName the source says OPERA1ER was also known by.OPERA1ERFinancially motivated cybercriminal syndicate responsible for attacks targeting financial institutions, mobile banking services, and telecom providers.
Vendors
Tools
BloodHoundThe gang harvested credentials, escalated privileges, and moved laterally using Mimikatz, BloodHound, and PowerSploit.Cobalt StrikeUnlike sophisticated threat actors who develop custom malware, OPERA1ER relied on open-source hacking programs, Remote Access Trojans (RATs), and penetration testing frameworks such as Metasploit and Cobalt Strike.Metasploit FrameworkUnlike sophisticated threat actors who develop custom malware, OPERA1ER relied on open-source hacking programs, Remote Access Trojans (RATs), and penetration testing frameworks such as Metasploit and Cobalt Strike.MimikatzThe gang harvested credentials, escalated privileges, and moved laterally using Mimikatz, BloodHound, and PowerSploit.PowerSploitThe gang harvested credentials, escalated privileges, and moved laterally using Mimikatz, BloodHound, and PowerSploit.
Countries
ArgentinaBeyond Africa, OPERA1ER extended its operations to South Asia and Latin America, targeting banks in Bangladesh, Paraguay, and Argentina.BangladeshBeyond Africa, OPERA1ER extended its operations to South Asia and Latin America, targeting banks in Bangladesh, Paraguay, and Argentina.BeninMost attacks took place in Africa, with confirmed incidents in Ivory Coast, Mali, Burkina Faso, Cameroon, Gabon, Niger, Nigeria, Senegal, Sierra Leone, Uganda, Togo, and Benin.Burkina FasoMost attacks took place in Africa, with confirmed incidents in Ivory Coast, Mali, Burkina Faso, Cameroon, Gabon, Niger, Nigeria, Senegal, Sierra Leone, Uganda, Togo, and Benin.CameroonMost attacks took place in Africa, with confirmed incidents in Ivory Coast, Mali, Burkina Faso, Cameroon, Gabon, Niger, Nigeria, Senegal, Sierra Leone, Uganda, Togo, and Benin.GabonMost attacks took place in Africa, with confirmed incidents in Ivory Coast, Mali, Burkina Faso, Cameroon, Gabon, Niger, Nigeria, Senegal, Sierra Leone, Uganda, Togo, and Benin.Ivory CoastMost attacks took place in Africa, with confirmed incidents in Ivory Coast, Mali, Burkina Faso, Cameroon, Gabon, Niger, Nigeria, Senegal, Sierra Leone, Uganda, Togo, and Benin.MaliMost attacks took place in Africa, with confirmed incidents in Ivory Coast, Mali, Burkina Faso, Cameroon, Gabon, Niger, Nigeria, Senegal, Sierra Leone, Uganda, Togo, and Benin.NigerMost attacks took place in Africa, with confirmed incidents in Ivory Coast, Mali, Burkina Faso, Cameroon, Gabon, Niger, Nigeria, Senegal, Sierra Leone, Uganda, Togo, and Benin.NigeriaMost attacks took place in Africa, with confirmed incidents in Ivory Coast, Mali, Burkina Faso, Cameroon, Gabon, Niger, Nigeria, Senegal, Sierra Leone, Uganda, Togo, and Benin.ParaguayBeyond Africa, OPERA1ER extended its operations to South Asia and Latin America, targeting banks in Bangladesh, Paraguay, and Argentina.SenegalMost attacks took place in Africa, with confirmed incidents in Ivory Coast, Mali, Burkina Faso, Cameroon, Gabon, Niger, Nigeria, Senegal, Sierra Leone, Uganda, Togo, and Benin.Sierra LeoneMost attacks took place in Africa, with confirmed incidents in Ivory Coast, Mali, Burkina Faso, Cameroon, Gabon, Niger, Nigeria, Senegal, Sierra Leone, Uganda, Togo, and Benin.TogoMost attacks took place in Africa, with confirmed incidents in Ivory Coast, Mali, Burkina Faso, Cameroon, Gabon, Niger, Nigeria, Senegal, Sierra Leone, Uganda, Togo, and Benin.UgandaMost attacks took place in Africa, with confirmed incidents in Ivory Coast, Mali, Burkina Faso, Cameroon, Gabon, Niger, Nigeria, Senegal, Sierra Leone, Uganda, Togo, and Benin.