- Category
- Criminal · Financially motivated: ransomware, fraud and theft.
- Origin
- Unknown
- Motivation
- Financial crime
- Seen
- 2016
- Sources
- 6 sources carry it
- Identifier
- GINC-APT-0274 · bluebottle
What it is
Bluebottle, a cyber-crime group that specializes in targeted attacks against the financial sector, is continuing to mount attacks on banks in Francophone countries. The group makes extensive use of living off the land, dual-use tools, and commodity malware, with no custom malware deployed in this campaign.
Names
The names each vendor, agency and source gives it. Naming differs by who tracks the actor, so one group carries many.
- Operations
- Operation “Nervone”
- Other names
- Common Raven, OPERA1ER, DESKTOP-GROUP, NXSMS
Targets
- Countries
- Argentina, Bangladesh, Benin, Burkina Faso, Cameroon, Cote d'Ivoire, Gabon, Mali, Niger, Nigeria, Paraguay, Senegal, Sierra Leone, Togo, Uganda
- Sectors
- Financial, Telecommunications
Tools
The tools and malware families the sources tie to it.
- Cyber Eye RAT
- CyberGate
Sources
- ETDA Threat Group Card apt.etda.or.th
- Malpedia malpedia.caad.fkie.fraunhofer.de