← All actors Recent activity

OPERA1ER

OPERA1ER · bluebottle · commonraven · desktop group

Indicators
81
Source reports
8
Activity span
not dated
Newest indicator
unknown
Upstream change
2026-01-02
20222023

Overview 81 indicators

No published description. This group is tracked by Maltrail from vendor reporting but is not named in MITRE ATT&CK, so there is no curated profile to show.

domain74OPERA1ER-domain.txt
url4OPERA1ER.json
ipv43OPERA1ER.json

Principal sources 8 reports

Ranked by how many of this actor's indicators each report brought in.

Timeline 81 indicators

Each entry is a batch of indicators that appeared upstream on one date, under the report it was filed with.

  1. 1 domain, 3 ipv4, 4 url3 yrs ago

    symantec-enterprise-blogs.security.com/blogs/threat-intelligence/bluebottle-ba… · virustotal.com/gui/file/fec7d1e96dd5903526317cdfec80d3… · virustotal.com/gui/file/ae4ff662c959cf24df621a2c0b934e…

    domaintransmissive-basin.000webhostapp.com
    ipv4178.73.192.15:8080
    ipv446.246.12.12:8080
    ipv446.246.14.17:7000
    urlhttp://178.73.192.15
    urlhttp://185.225.73.165
    urlhttp://46.246.86.12
    urlhttp://85.239.34.152

  2. 72 domain4 yrs ago

    twitter.com/blackorbird/status/1588353576723976192 · c-apt-ure.blogspot.com/2022/01/who-is-desktop-group.html · group-ib.com/media-center/press-releases/opera1er · github.com/blackorbird/APT_REPORT/blob/master/cybe… · virustotal.com/gui/file/6d87cce7f7e7ed51fc01fad000a8f6…

    4x33.ignorelist.com
    actu.afrikmedia.info
    actu.banquealtantique.net
    afijoh.net
    afrikmedia.info
    bac.eimaragon.org
    bac.senegalsante.org
    boa.eimaragon.org
    cnam.myvnc.com
    cobalt.warii.club
    codir.ocitnetad.com
    contact.senegalsante.org
    coris-bank.fr
    covid.ocitnetad.com
    crazy.senegalsante.org
    dc-4ade33bd8726.bdm-sa.fr
    direct8.ddns.net
    download.nortonupdate.com
    driver.eimaragon.org
    droid.senegalsante.org
    dynastie.warzonedns.com
    eimanet.eimaragon.org
    eimaragon.org
    evamachine.tk
    ftp.eimaragon.org
    gamevnc.myvnc.com
    helpdesk-security.org
    hostmaster.senegalsante.org
    hunterx1-37009.portmap.io
    info.senegalsante.org
    info.warii.club
    kaspersky-lab.org
    kpersky.duckdns.org
    mail.mcafee-endpoint.com
    mail.warii.club
    microsoft-af.com
    news.afrikmedia.info
    news.coris-bank.fr
    noreply.mcafee-endpoint.com
    ns.eimaragon.org
    ns1.eimaragon.org
    ns1.senegalsante.org
    ns2.senegalsante.org
    ocitnetad.com
    operan.ddns.net
    queen2012.ddns.net
    reply2host.duckdns.org
    senegalsante.org
    server.senegalsante.org
    server0.senegalsante.org
    server1.senegalsante.org
    server2.senegalsante.org
    server3.senegalsante.org
    serveur1.hopto.org
    srvopm.ocitnetad.ci
    update.kaspersky-lab.org
    update.mcafee-endpoint.com
    update.microsoft-af.com
    utils.afijoh.net
    wa.eimaragon.org
    wari.warii.club
    warii.club
    warima.warii.club
    webdisk.bdm-sa.fr
    windowsdefender.redirectme.net
    windowsupgraders.ddns.net
    winsec.eimaragon.org
    winsec.gotdns.ch
    winsec.senegalsante.org
    winsec.warii.club
    wsus.microsoft-af.com
    zfs.life

  3. 1 domain4 yrs ago

    twitter.com/blackorbird/status/1588353576723976192 · c-apt-ure.blogspot.com/2022/01/who-is-desktop-group.html · group-ib.com/media-center/press-releases/opera1er · github.com/blackorbird/APT_REPORT/blob/master/cybe… · virustotal.com/gui/file/6d87cce7f7e7ed51fc01fad000a8f6… · symantec-enterprise-blogs.security.com/blogs/threat-intelligence/bluebottle-ba… · virustotal.com/gui/file/fec7d1e96dd5903526317cdfec80d3… · virustotal.com/gui/file/ae4ff662c959cf24df621a2c0b934e…

    personnel.bdm-sa.fr

Further reading 8