Opera Browser and Cobalt Strike Attacker

An unidentified intrusion actor observed during the mass exploitation of Microsoft Exchange Server vulnerabilities in 2021. This actor used the Exchange compromise to obtain high-privilege access and then conducted post-exploitation activity with a combination of living-off-the-land tooling and commodity offensive frameworks. A notable tradecraft element was the use of BITSAdmin and encoded PowerShell to retrieve a legitimate Opera Browser executable vulnerable to DLL search order hijacking via CVE-2018-18913, alongside malicious DLLs placed in the same directory to trigger execution. This infection chain ultimately led to deployment of Cobalt Strike. The actor’s observed behavior is consistent with hands-on-keyboard post-compromise operations rather than a uniquely attributed intrusion set. Reported activity associated with the broader exploitation cluster included webshell use, credential dumping, reconnaissance, ingress tool transfer, defense evasion through file hiding and deletion, and use of remote administration or staging utilities. Cobalt Strike use in this context is consistent with follow-on access enablement and post-exploitation, and the surrounding campaign environment included ransomware-related activity by multiple actors exploiting the same Exchange vulnerabilities. However, no high-confidence public attribution to a specific named threat group or country is established for this Opera Browser DLL-sideloading and Cobalt Strike operator.