Bluebottle Cybercrime Group Preys on Monetary Sector in French-Talking African Nations

Jan 05, 2023Ravie LakshmananCybercrime / Banking Safety

A cybercrime group dubbed Bluebottle has been linked to a set of focused assaults towards the monetary sector in Francophone nations situated in Africa from at the very least July 2022 to September 2022.

“The group makes intensive use of living-off-the-land, twin use instruments, and commodity malware, with no customized malware deployed on this marketing campaign,” Symantec, a division of Broadcom Software program, said in a report shared with The Hacker Information.

The cybersecurity agency stated the exercise shares overlaps with a menace cluster tracked by Group-IB underneath the identify OPERA1ER, which has carried out dozens of assaults aimed toward banks, monetary companies, and telecom corporations in Africa, Asia, and Latin America between 2018 and 2022.

The attribution stems from similarities within the toolset used, the assault infrastructure, the absence of bespoke malware, and the concentrating on of French-speaking nations in Africa. Three totally different unnamed monetary establishments in three African nations have been breached, though it isn’t identified whether or not Bluebottle efficiently monetized the assaults.

The financially motivated adversary, additionally identified by the identify DESKTOP-GROUP, has been accountable for a string of heists totaling $11 million, with precise damages touching $30 million.

The latest assaults illustrate the group’s evolving ways, together with using an off-the-shelf malware named GuLoader within the early phases of the an infection chain in addition to weaponizing kernel drivers to disable safety defenses.

Symantec stated it could not hint the preliminary intrusion vector, though it detected job-themed information on the sufferer networks, indicating that hiring associated phishing lures have been possible put to make use of to trick the targets into opening malicious e-mail attachments.

What’s extra, an assault detected in mid-Could 2022 concerned the supply of an data stealer malware within the type of a ZIP file containing an executable display saver (.SCR) file. Additionally noticed in July 2022 was using an optical disc picture (.ISO) file, which has been utilized by many a menace actor as a way of distributing malware.

“If the Bluebottle and OPERA1ER actors are certainly one and the identical, this may imply that they swapped out their an infection methods between Could and July 2022,” the researchers famous.

The spear-phishing attachments result in the deployment of GuLoader, which subsequently acts as a conduit to drop further payloads on the machine, comparable to Netwire, Quasar RAT, and Cobalt Strike Beacon. Lateral motion is facilitated by means of instruments like PsExec and SharpHound.

One other method adopted by the group is using a signed helper driver to terminate safety software program, a way that has been utilized by a number of hacking crews for related functions, in keeping with findings from Mandiant, SentinelOne, and Sophos final month.

The truth that the identical driver (referred to as POORTRY by Mandiant) has been leveraged by a number of cybercriminal teams lends credence to the idea that these menace actors are utilizing a code signing service to get their malware cross attestation mechanisms.

With the menace actors suspected to be French-speaking, it is possible that the assaults may develop to different French-speaking nations the world over, the corporate cautioned.

“The effectiveness of its campaigns implies that Bluebottle is unlikely to cease this exercise,” the researchers stated. “It seems to be very centered on Francophone nations in Africa, so monetary establishments in these nations ought to stay on excessive alert.”