Skip to content
skopnix
Adversaries · Dossier
← Adversaries

File · Common Raven · Unknown · misp-galaxy · refreshed 2026-10-06

Common Raven

  • OPERA1ER
  • NXSMS
  • DESKTOP-GROUP

sigil · no ATT&CK coverage stated

Analyst brief

misp-galaxy

Threat actor Common Raven has been actively targeting financial sector institutions, compromising their SWIFT payment infrastructure to send out fraudulent payments.

Detections

9 rules · Sigma · QRadar · Cortex

  1. Actor indicator sweep

    Common Raven IP indicators

    Common Raven

    T1071conf 77SIGAQLXQL

  2. Indicator

    Malicious IPs

    APT19 · Callisto · Common Raven · GreenSpot · Operation C-Major · Tortoiseshell · 2 more

    T1071conf 77AQL

  3. Indicator

    Outbound connection to known-malicious IP

    APT19 · Callisto · Common Raven · GreenSpot · Operation C-Major · Tortoiseshell · 2 more

    T1071conf 77AQL

  4. Indicator

    Traffic to known C2 IP 178.73.192.17

    Common Raven

    T1071conf 77SIGXQL

  5. Indicator

    Traffic to known C2 IP 46.246.84.17

    Common Raven

    T1071conf 77SIGXQL

Generated by skopnix from this finding, each with false-positive notes. Open the list →

Take it with you

keyless · no signup

References

3 sources
  1. 1.rewterz.com/rewterz-news/rewterz-threat-alert-common-raven-iocs
  2. 2.www2.swift.com/isac/report/10118
  3. 3.blog.group-ib.com/opera1er-apt

Track Common Raven on the wire.

This dossier is already data: the keyless actor API and a STIX 2.1 bundle. Mentions on the wire reach Telegram and RSS as they land.

Follow on TelegramKEV RSSAPI

Check your stack

Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.

Stack checkNo key. No signup.