UnclassifiedUnknown

Common Raven

Common Raven is a threat actor group, tracked by Brandefense. It targets the Finance sector in 4 countries, including Argentina and Bangladesh.

Also known as

OPERA1ER
NXSMS
DESKTOP-GROUP

Request IOC feed Request ATT&CK export

Techniques: 0
Exploited CVEs: No CVE data
First seen: Jan 1, 2018
Last seen: Jan 1, 2022
Record updated: Oct 19, 2026

Who They Target.

Sectors · 1

Finance

Countries · 4

Vulnerabilities Linked To Their Tools.

Browse Vulnerability Intelligence →

CVE-2021-44228Apache Log4j2 contains a vulnerability where JNDI features do not protect against attacker-controlled JNDI-related endpoints, allowing for remote code execution.Exploitedcritical CVE-2024-57726SimpleHelp contains a missing authorization vulnerability that could allow low-privileged technicians to create API keys with excessive permissions.Exploitedcritical CVE-2023-48788Fortinet FortiClient EMS contains a SQL injection vulnerability that allows an unauthenticated attacker to execute commands as SYSTEM via specifically crafted requests.Exploitedcritical CVE-2024-21887Ivanti Connect Secure (ICS, formerly known as Pulse Connect Secure) and Ivanti Policy Secure contain a command injection vulnerability in the web components of these products…Exploitedcritical CVE-2023-46805Ivanti Connect Secure (ICS, formerly known as Pulse Connect Secure) and Ivanti Policy Secure gateways contain an authentication bypass vulnerability in the web component that…Exploitedhigh CVE-2024-21893Ivanti Connect Secure (ICS, formerly known as Pulse Connect Secure), Ivanti Policy Secure, and Ivanti Neurons contain a server-side request forgery (SSRF) vulnerability in the…Exploitedhigh CVE-2024-21412Microsoft Windows Internet Shortcut Files contains an unspecified vulnerability that allows for a security feature bypass.Exploitedhigh CVE-2024-57727SimpleHelp remote support software contains multiple path traversal vulnerabilities that allow unauthenticated remote attackers to download arbitrary files from the SimpleHelp…Exploitedhigh CVE-2024-57728SimpleHelp contains a path traversal vulnerability that allows admin users to upload arbitrary files anywhere on the file system by uploading a crafted zip file (i.e.Exploitedhigh CVE-2024-29868Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) vulnerability in Apache StreamPipes user self-registration and password recovery mechanism.critical

Arsenal · Malware And Tools.

Bloodhoundmalware
CobaltStrikemalware
Metasploitmalware
MimiKatzmalware
PowerSploitmalware

About Common Raven.

Threat actor Common Raven has been actively targeting financial sector institutions, compromising their SWIFT payment infrastructure to send out fraudulent payments.

Last updated Oct 19, 2026. Compiled by Brandefense technologies from structured threat intelligence and reviewed by Brandefense analysts. Techniques follow the MITRE ATT&CK framework.