Bluebottle Attacks The Financial Sector In Africa

The Bluebottle threat group, also known as Common Raven and OPERA1ER, targeted the financial sector in French speaking countries in Africa with a range of dual-use tools, commodity malware, and living-of-the-land utilities. The various tools and malicious software were used for discovery, network tunneling, persistence, and defense evasion. The Netwire and Quasar RATs along with Cobalt Strike, GuLoader, Mimikatz, and multiple Microsoft Windows command-line utilities were used to carry out the operation.