{ "aliases": [ "bluebottle", "commonraven", "desktop group" ], "attack_id": null, "attack_name": null, "attack_url": null, "counts": { "domain": 74, "ipv4": 3, "url": 4 }, "first_seen": { "domain": { "4x33.ignorelist.com": "2022-11-06", "actu.afrikmedia.info": "2022-11-06", "actu.banquealtantique.net": "2022-11-06", "afijoh.net": "2022-11-06", "afrikmedia.info": "2022-11-06", "bac.eimaragon.org": "2022-11-06", "bac.senegalsante.org": "2022-11-06", "boa.eimaragon.org": "2022-11-06", "cnam.myvnc.com": "2022-11-06", "cobalt.warii.club": "2022-11-06", "codir.ocitnetad.com": "2022-11-06", "contact.senegalsante.org": "2022-11-06", "coris-bank.fr": "2022-11-06", "covid.ocitnetad.com": "2022-11-06", "crazy.senegalsante.org": "2022-11-06", "dc-4ade33bd8726.bdm-sa.fr": "2022-11-06", "direct8.ddns.net": "2022-11-06", "download.nortonupdate.com": "2022-11-06", "driver.eimaragon.org": "2022-11-06", "droid.senegalsante.org": "2022-11-06", "dynastie.warzonedns.com": "2022-11-06", "eimanet.eimaragon.org": "2022-11-06", "eimaragon.org": "2022-11-06", "evamachine.tk": "2022-11-06", "ftp.eimaragon.org": "2022-11-06", "gamevnc.myvnc.com": "2022-11-06", "helpdesk-security.org": "2022-11-06", "hostmaster.senegalsante.org": "2022-11-06", "hunterx1-37009.portmap.io": "2022-11-06", "info.senegalsante.org": "2022-11-06", "info.warii.club": "2022-11-06", "kaspersky-lab.org": "2022-11-06", "kpersky.duckdns.org": "2022-11-06", "mail.mcafee-endpoint.com": "2022-11-06", "mail.warii.club": "2022-11-06", "microsoft-af.com": "2022-11-06", "news.afrikmedia.info": "2022-11-06", "news.coris-bank.fr": "2022-11-06", "noreply.mcafee-endpoint.com": "2022-11-06", "ns.eimaragon.org": "2022-11-06", "ns1.eimaragon.org": "2022-11-06", "ns1.senegalsante.org": "2022-11-06", "ns2.senegalsante.org": "2022-11-06", "ocitnetad.com": "2022-11-06", "operan.ddns.net": "2022-11-06", "personnel.bdm-sa.fr": "2022-11-06", "queen2012.ddns.net": "2022-11-06", "reply2host.duckdns.org": "2022-11-06", "senegalsante.org": "2022-11-06", "server.senegalsante.org": "2022-11-06", "server0.senegalsante.org": "2022-11-06", "server1.senegalsante.org": "2022-11-06", "server2.senegalsante.org": "2022-11-06", "server3.senegalsante.org": "2022-11-06", "serveur1.hopto.org": "2022-11-06", "srvopm.ocitnetad.ci": "2022-11-06", "transmissive-basin.000webhostapp.com": "2023-01-06", "update.kaspersky-lab.org": "2022-11-06", "update.mcafee-endpoint.com": "2022-11-06", "update.microsoft-af.com": "2022-11-06", "utils.afijoh.net": "2022-11-06", "wa.eimaragon.org": "2022-11-06", "wari.warii.club": "2022-11-06", "warii.club": "2022-11-06", "warima.warii.club": "2022-11-06", "webdisk.bdm-sa.fr": "2022-11-06", "windowsdefender.redirectme.net": "2022-11-06", "windowsupgraders.ddns.net": "2022-11-06", "winsec.eimaragon.org": "2022-11-06", "winsec.gotdns.ch": "2022-11-06", "winsec.senegalsante.org": "2022-11-06", "winsec.warii.club": "2022-11-06", "wsus.microsoft-af.com": "2022-11-06", "zfs.life": "2022-11-06" }, "ipv4": { "178.73.192.15:8080": "2023-01-06", "46.246.12.12:8080": "2023-01-06", "46.246.14.17:7000": "2023-01-06" }, "url": { "http://178.73.192.15": "2023-01-06", "http://185.225.73.165": "2023-01-06", "http://46.246.86.12": "2023-01-06", "http://85.239.34.152": "2023-01-06" } }, "first_seen_precision": { "domain": {}, "ipv4": {}, "url": {} }, "first_seen_range": { "earliest": "2022-11-06", "latest": "2023-01-06" }, "generated_at": "2026-08-08T03:26:30+00:00", "indicators": { "domain": [ "4x33.ignorelist.com", "actu.afrikmedia.info", "actu.banquealtantique.net", "afijoh.net", "afrikmedia.info", "bac.eimaragon.org", "bac.senegalsante.org", "boa.eimaragon.org", "cnam.myvnc.com", "cobalt.warii.club", "codir.ocitnetad.com", "contact.senegalsante.org", "coris-bank.fr", "covid.ocitnetad.com", "crazy.senegalsante.org", "dc-4ade33bd8726.bdm-sa.fr", "direct8.ddns.net", "download.nortonupdate.com", "driver.eimaragon.org", "droid.senegalsante.org", "dynastie.warzonedns.com", "eimanet.eimaragon.org", "eimaragon.org", "evamachine.tk", "ftp.eimaragon.org", "gamevnc.myvnc.com", "helpdesk-security.org", "hostmaster.senegalsante.org", "hunterx1-37009.portmap.io", "info.senegalsante.org", "info.warii.club", "kaspersky-lab.org", "kpersky.duckdns.org", "mail.mcafee-endpoint.com", "mail.warii.club", "microsoft-af.com", "news.afrikmedia.info", "news.coris-bank.fr", "noreply.mcafee-endpoint.com", "ns.eimaragon.org", "ns1.eimaragon.org", "ns1.senegalsante.org", "ns2.senegalsante.org", "ocitnetad.com", "operan.ddns.net", "personnel.bdm-sa.fr", "queen2012.ddns.net", "reply2host.duckdns.org", "senegalsante.org", "server.senegalsante.org", "server0.senegalsante.org", "server1.senegalsante.org", "server2.senegalsante.org", "server3.senegalsante.org", "serveur1.hopto.org", "srvopm.ocitnetad.ci", "transmissive-basin.000webhostapp.com", "update.kaspersky-lab.org", "update.mcafee-endpoint.com", "update.microsoft-af.com", "utils.afijoh.net", "wa.eimaragon.org", "wari.warii.club", "warii.club", "warima.warii.club", "webdisk.bdm-sa.fr", "windowsdefender.redirectme.net", "windowsupgraders.ddns.net", "winsec.eimaragon.org", "winsec.gotdns.ch", "winsec.senegalsante.org", "winsec.warii.club", "wsus.microsoft-af.com", "zfs.life" ], "ipv4": [ "178.73.192.15:8080", "46.246.12.12:8080", "46.246.14.17:7000" ], "url": [ "http://178.73.192.15", "http://185.225.73.165", "http://46.246.86.12", "http://85.239.34.152" ] }, "last_modified": "2026-01-02T23:10:15+00:00", "maltrail_groups": [ "OPERA1ER" ], "references": [ "http://c-apt-ure.blogspot.com/2022/01/who-is-desktop-group.html", "https://github.com/blackorbird/APT_REPORT/blob/master/cybercrime/OPERA1ER/Group-IB_RPRT_OPERA1ER_EN_full.pdf", "https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/bluebottle-banks-targeted-africa", "https://twitter.com/blackorbird/status/1588353576723976192", "https://www.group-ib.com/media-center/press-releases/opera1er/", "https://www.virustotal.com/gui/file/6d87cce7f7e7ed51fc01fad000a8f6d8c715393873116b14fe2bc0abbb6086d8/detection", "https://www.virustotal.com/gui/file/ae4ff662c959cf24df621a2c0b934ed1fa1c26a270a180f695cd5295579afbbd/detection", "https://www.virustotal.com/gui/file/fec7d1e96dd5903526317cdfec80d3f69c393cfb115fdda3bd28e3c383eb856a/detection" ], "related": [], "slug": "OPERA1ER", "timeline": [ { "counts": { "domain": 1, "ipv4": 3, "url": 4 }, "first_seen": "2023-01-06", "indicators": { "domain": [ "transmissive-basin.000webhostapp.com" ], "ipv4": [ "178.73.192.15:8080", "46.246.12.12:8080", "46.246.14.17:7000" ], "url": [ "http://178.73.192.15", "http://185.225.73.165", "http://46.246.86.12", "http://85.239.34.152" ] }, "precision": "exact", "references": [ "https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/bluebottle-banks-targeted-africa", "https://www.virustotal.com/gui/file/fec7d1e96dd5903526317cdfec80d3f69c393cfb115fdda3bd28e3c383eb856a/detection", "https://www.virustotal.com/gui/file/ae4ff662c959cf24df621a2c0b934ed1fa1c26a270a180f695cd5295579afbbd/detection" ], "total": 8 }, { "counts": { "domain": 72 }, "first_seen": "2022-11-06", "indicators": { "domain": [ "4x33.ignorelist.com", "actu.afrikmedia.info", "actu.banquealtantique.net", "afijoh.net", "afrikmedia.info", "bac.eimaragon.org", "bac.senegalsante.org", "boa.eimaragon.org", "cnam.myvnc.com", "cobalt.warii.club", "codir.ocitnetad.com", "contact.senegalsante.org", "coris-bank.fr", "covid.ocitnetad.com", "crazy.senegalsante.org", "dc-4ade33bd8726.bdm-sa.fr", "direct8.ddns.net", "download.nortonupdate.com", "driver.eimaragon.org", "droid.senegalsante.org", "dynastie.warzonedns.com", "eimanet.eimaragon.org", "eimaragon.org", "evamachine.tk", "ftp.eimaragon.org", "gamevnc.myvnc.com", "helpdesk-security.org", "hostmaster.senegalsante.org", "hunterx1-37009.portmap.io", "info.senegalsante.org", "info.warii.club", "kaspersky-lab.org", "kpersky.duckdns.org", "mail.mcafee-endpoint.com", "mail.warii.club", "microsoft-af.com", "news.afrikmedia.info", "news.coris-bank.fr", "noreply.mcafee-endpoint.com", "ns.eimaragon.org", "ns1.eimaragon.org", "ns1.senegalsante.org", "ns2.senegalsante.org", "ocitnetad.com", "operan.ddns.net", "queen2012.ddns.net", "reply2host.duckdns.org", "senegalsante.org", "server.senegalsante.org", "server0.senegalsante.org", "server1.senegalsante.org", "server2.senegalsante.org", "server3.senegalsante.org", "serveur1.hopto.org", "srvopm.ocitnetad.ci", "update.kaspersky-lab.org", "update.mcafee-endpoint.com", "update.microsoft-af.com", "utils.afijoh.net", "wa.eimaragon.org", "wari.warii.club", "warii.club", "warima.warii.club", "webdisk.bdm-sa.fr", "windowsdefender.redirectme.net", "windowsupgraders.ddns.net", "winsec.eimaragon.org", "winsec.gotdns.ch", "winsec.senegalsante.org", "winsec.warii.club", "wsus.microsoft-af.com", "zfs.life" ] }, "precision": "exact", "references": [ "https://twitter.com/blackorbird/status/1588353576723976192", "http://c-apt-ure.blogspot.com/2022/01/who-is-desktop-group.html", "https://www.group-ib.com/media-center/press-releases/opera1er/", "https://github.com/blackorbird/APT_REPORT/blob/master/cybercrime/OPERA1ER/Group-IB_RPRT_OPERA1ER_EN_full.pdf", "https://www.virustotal.com/gui/file/6d87cce7f7e7ed51fc01fad000a8f6d8c715393873116b14fe2bc0abbb6086d8/detection" ], "total": 72 }, { "counts": { "domain": 1 }, "first_seen": "2022-11-06", "indicators": { "domain": [ "personnel.bdm-sa.fr" ] }, "precision": "exact", "references": [ "https://twitter.com/blackorbird/status/1588353576723976192", "http://c-apt-ure.blogspot.com/2022/01/who-is-desktop-group.html", "https://www.group-ib.com/media-center/press-releases/opera1er/", "https://github.com/blackorbird/APT_REPORT/blob/master/cybercrime/OPERA1ER/Group-IB_RPRT_OPERA1ER_EN_full.pdf", "https://www.virustotal.com/gui/file/6d87cce7f7e7ed51fc01fad000a8f6d8c715393873116b14fe2bc0abbb6086d8/detection", "https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/bluebottle-banks-targeted-africa", "https://www.virustotal.com/gui/file/fec7d1e96dd5903526317cdfec80d3f69c393cfb115fdda3bd28e3c383eb856a/detection", "https://www.virustotal.com/gui/file/ae4ff662c959cf24df621a2c0b934ed1fa1c26a270a180f695cd5295579afbbd/detection" ], "total": 1 } ] }