Financially motivated, dangerously activated: OPERA1ER APT in Africa

**OPERA1ER: Playing God without permission** — Group-IB and Orange describe a French-speaking criminal APT (aka DESKTOP-GROUP/Common Raven/NXSMS) responsible for 30+ targeted attacks on African banks, financial services, and telecoms from 2018–2022, with confirmed thefts of at least $11M; the report maps TTPs (Cobalt Strike, BitRAT, VPN/DynDNS), publishes new Cobalt Strike servers and fingerprints, and supplies IOCs and hunting heuristics for tracking their infrastructure.