Common Raven

Executive Summary

Common Raven is a threat actor targeting financial institutions, exploiting SWIFT infrastructure to divert funds through fraudulent payments. This group's operations suggest a focus on stealthy, persistent access to enable long-term financial exploitation. The lack of confirmed aliases or full TTPs highlights the need for further analysis to fully understand their capabilities and affiliations.

Goals & Targeting

Common Raven's primary objective appears to be monetary gain through fraudulent financial transactions, targeting SWIFT systems due to their central role in global banking operations. The group focuses on financial institutions, particularly those with international transaction capabilities, as these provide access to large sums of money with potential for global movement. The lack of geographic constraints in targeting suggests a broad operational interest in any institution with SWIFT access, emphasizing the need for enhanced defenses across the global financial sector.

Common Raven is a financially motivated threat actor primarily targeting financial sector organizations, with a focus on compromising SWIFT systems to divert funds through fraudulent transactions. While specific technical details are sparse, the group's activities indicate a high level of operational sophistication, including the ability to infiltrate secure financial networks and execute complex payment manipulations. The actor's stealthy approach and specific focus on SWIFT infrastructure suggest a well-coordinated operation aimed at exploiting critical financial system vulnerabilities. Although no confirmed links to known APT groups or state-backed actors have been established, the group's tactics align with known patterns of cybercriminal organizations targeting global banking systems for financial gain.

Key Capabilities

• Exploitation of SWIFT system vulnerabilities
• Custom malware deployment for financial system manipulation
• Spear-phishing campaigns targeting financial sector personnel
• Network infiltration techniques for long-term persistence
• Credential harvesting for elevated system access

MITRE ATT&CK Tactics

ATT&CK Techniques

Software / Tooling

Campaigns & Victims

Common Raven's campaigns appear to follow a slow, stealthy pattern, prioritizing long-term access over immediate exfiltration. Operations typically begin with spear-phishing to gain initial access, followed by lateral movement to reach SWIFT systems. The group's focus on financial institutions and infrastructure suggests a high level of technical expertise and a clear understanding of banking system architectures. While no specific campaigns have been publicly attributed to this group, their methods align with known SWIFT compromise patterns observed in other cybercriminal operations.

IOC Patterns

• Spear-phishing emails with macro-laced Office documents
• C2 communication over DNS using fast-flux infrastructure
• Staging of malicious payloads on bulletproof hosting services
• Abnormal SWIFT message patterns with irregular transaction metadata
• Unusual network traffic to obscure IP ranges in compromised regions

Recommended Actions

• Implement advanced email filtering for macro-laced documents
• Monitor SWIFT transaction metadata for anomalies
• Deploy network traffic analysis for DNS-based C2 detection
• Conduct regular phishing simulations for financial staff
• Implement multi-factor authentication for SWIFT system access
• Perform penetration testing of SWIFT infrastructure components

Suggested Tags