Francophone hackers stole $11m , cause $50m damages in Nigeria, others

Sopuruchi Onwuka, with agency reports

Internet fraud syndicate operating from one of Nigeria’s neighbouring francophone countries have successfully launched over  30 successful attacks at financial institutions and stole over $11 million, causing damages worth over $50 million to the institutions.

A report by the Orange Group stated that the actual amount of damage could be up to five times higher than the amount stolen.

Singapore-based cyber security firm Group IB and Orange CERT, the IT security arm of French telecommunications company Orange have revealed in a new report that 12 African countries lost millions of dollars to a hacking group based in an unknown French-speaking African country.

The threat actor, which mainly targeted Francophone Africa was codenamed OPERA1ER and relied solely on known off-the-shelf tools. It managed to launch over 30 successful attacks against banks, financial services providers, and telecommunication companies between 2018 and 2022, stealing $11 million in the process.

The actual amount of damage could be up to five times higher than the amount stolen.

“According to our calculations, the total amount of damage ranges from $30 million to $50 million. However, this could be even more,” Rustam Mirkasymov, head of cyber threat research at Group-IB’s European Threat Intelligence & Research Center in Amsterdam tells Quartz.

Affected countries are Côte d’Ivoire, Mali, Burkina Faso, Benin, Cameroon, Gabon, Niger, Nigeria, Senegal, Sierra Leone, Togo, and Uganda. Those outside Africa are Argentina, Bangladesh, and Paraguay. Most victims were attacked twice, and “their infrastructure was then used to attack other organizations.”

OPERA1ER, which also goes by the names DESKTOP-group and Common Raven traces its roots back to 2016 when it registered its first domain.

It conducts cyber-attacks over the weekends or during public holidays because according to Mirkasymov, “it is much more difficult to stop fraudulent transactions or stop an attack on these days. Even if someone detects an attempt to withdraw money, during the weekend it is not easy to stop them and get the money back.”

The report says that OPERA1ER is a seasoned threat actor and once it noticed it was being traced, it deleted its accounts and changed its trails to cover its activity last year. But it resurfaced this year.

Mirkasymov explains: “It correlates with the fact that they spend from three to 12 months from the initial access to money theft. The exact number of the gang members is unknown.”

But contrary to modern attackers who use sophisticated software and technology such as deep learning to clone fingerprints and steal passwords, OPERA1ER uses off-the-shelf open-source programs, malware freely available on the dark web, and popular red teaming frameworks, such as Metasploit and Cobalt Strike. Red teaming is a cybersecurity technique used to test how an organization would respond to a real cyberattack.

“In at least two incidents in different banks, the attackers deployed Metasploit servers inside compromised infrastructure. Because the gang relies solely on public tools, they have to think outside the box: in one incident, it used an antivirus update server deployed in the infrastructure as a pivoting point,” the report explains.

But it starts its attacks with a very familiar tactic—high-quality spear phishing emails targeting a specific employees within an organization with most of its messages written in French, “ranging from fake notifications from government tax offices to hiring offers from the Central Bank of West African States.”

Under the guise of legitimate email document attachment, OPERA1ER distributes Remote Access Trojans, such as Netwire, bitrat, venomRAT, AgentTesla, Remcos, Neutrino, BlackNET, Venom RAT, as well as password sniffers and dumpers, the report says.

Once it gains access the hacking group uses the information in further targeted phishing but takes time to study internal documentation to better prepare for the cashing out stage.

In one case, the study shows, a network of more than 400 subscriber accounts controlled by money mules hired by OPERA1ER was used to enable the cashing out of the stolen funds, mostly done overnight via ATMs.

In at least in two bank cases, OPERA1ER managed to get access to the global SWIFT messaging interface software (presumably Alliance Access) running on the banks’ computers. Though SWIFT was not compromised in the process, “the attackers were able to break into the systems inside the banks where this software was installed.” In 2018, hackers stole $6 million in an attack on the SWIFT system.

In the recent past Africa has been ill-prepared for cyber threats, losing $4 billion a year but new efforts by individual countries are expected to raise cybersecurity resilience and help companies prepare better.

The African Development Bank granted $2 million to the African Cybersecurity Resource Center (ACRC) for Financial Inclusion last year to tackle cybercrime. In August, Togo, in collaboration with the United Nations Economic Commission for Africa set up a cybersecurity monitoring center in Lome to serve the entire continent.