- Category
- Hacktivist · Political or nationalist, often disruption and leaks.
- Origin
- Palestine(medium confidence)
- Sources
- 3 sources carry it
- Identifier
- GINC-APT-0653 · blackmeta
What it is
BLACKMETA is a pro-Palestinian hacktivist group that has claimed responsibility for a series of DDoS attacks and data breaches targeting organizations perceived as supportive of Israel, including the Internet Archive and various entities in the UAE and Saudi Arabia. The group employs DDoS attacks, website defacement, and data exfiltration, with motivations rooted in political ideology and retribution for perceived injustices against Palestinians. Their operations have been linked to a Telegram channel, where they publicize their activities and collaborate with other hacktivist groups. Additionally, they have been attributed to significant cyber disruptions, including a 100-hour DDoS campaign against a UAE bank, showcasing their operational capabilities.
Names
The names each vendor, agency and source gives it. Naming differs by who tracks the actor, so one group carries many.
- Other names
- SN Blackmeta
Attribution
Each attribution is a claim: who makes it, and to whom. Western and Eastern sources are kept apart, as they often disagree.
Western sources
- MISP Galaxy (CFR tagging)Palestine
Tools
The tools and malware families the sources tie to it.
- Arabian-Attacker RAT
- BLACKCOFFEE
- BlackEnergy
- BlackHole
- BlackNix
- Blackshades
- Cyber Eye RAT
- CyberGate
Sources
- Malpedia malpedia.caad.fkie.fraunhofer.de