Hackers steal $11m from Nigerian companies, others

A gang of hackers, code-named OPERA1ER, have reportedly stolen an estimated sum of $11m from companies in Nigeria, Republic of Benin, Cameroon, 11 other African countries, and Argentina.

How it happened: This was contained in a new report from Group-IB, a cybersecurity firm, entitled, “OPERA1ER: Playing God without permission,” in collaboration with the researchers from Orange CERT Coordination Center.

The company disclosed that digital forensic artifacts analysed by it and Orange tracked more than 30 successful intrusions of the gang between 2018 and 2022.

The firm’s report revealed that companies in the Ivory Coast were the most targeted.

It said this helped it to trace affected organisations in Ivory Coast, Mali, Burkina Faso, Benin, Cameroon, Bangladesh, Gabon, Niger, Nigeria, Paraguay, Senegal, Sierra Leone, Uganda, Togo, and Argentina.

Group-IB added that while it estimated that the gang stole $11m, it could have actually stolen as high as $30m.

The company’s statement read: “The report takes a deep dive into financially motivated attacks of the prolific French-speaking threat actor, codenamed OPERA1ER.

“Despite relying solely on known ‘off-the-shelf’ tools, the gang managed to carry out more than 30 successful attacks against banks, financial services, and telecommunication companies mainly located in Africa between 2018 and 2022. OPERA1ER is confirmed to have stolen at least $11m, according to Group-IB’s estimates.

“One of OPERA1ER’s attacks involved a vast network of 400 mule accounts for fraudulent money withdrawals. Researchers from the Group-IB European Threat Intelligence Unit identified and reached out to 16 affected organizations so they could mitigate the threat and prevent further attacks by OPERA1ER.”

The cybersecurity coy also stated that the report was completed in 2021 when the threat was still active.

Group-IB Europe’s head of cyber threat research, Rustam Mirkasymov, said, “Detailed analysis of the gang’s recent attacks revealed an interesting pattern in their modus operandi: OPERA1ER conducts attacks mainly during the weekends or public holidays.

“It correlates with the fact that they spend from 3 to 12 months from the initial access to money theft. It was established that the French-speaking hacker group could operate from Africa. The exact number of the gang members is unknown.”