- Category
- Targeted, sponsor unknown · Targeted intrusions with no sponsor attributed.
- Origin
- Unknown
- Motivation
- Information theft and espionage
- Seen
- 2015–2026
- Status
- Active
- ATT&CK
- G0063 · 1 techniques
- Sources
- 11 sources carry it
- Identifier
- GINC-APT-0043 · blackoasis
What it is
BlackOasis is a Middle Eastern threat group that is believed to be a customer of Gamma Group. The group has shown interest in prominent figures in the United Nations, as well as opposition bloggers, activists, regional news correspondents, and think tanks. A group known by Microsoft as NEODYMIUM is reportedly associated closely with BlackOasis operations, but evidence that the group names are aliases has not been identified.
Names
The names each vendor, agency and source gives it. Naming differs by who tracks the actor, so one group carries many.
- MITRE ATT&CK
- G0063
Targets
- Countries
- Afghanistan, Angola, Bahrain, Iran, Iraq, Jordan, Libya, Netherlands, Nigeria, Russia, Saudi Arabia, Tunisia, United Kingdom
- Sectors
- Media, Think Tanks
Tools
The tools and malware families the sources tie to it.
- 0-day vulnerabilities in Flash
- BLACKCOFFEE
- BlackEnergy
- BlackHole
- BlackNix
- Blackshades
- CVE-2015-5119 – June 2015
- CVE-2016-0984 – June 2015
- CVE-2016-4117 – May 2016
- CVE-2017-11292 – Oct 2017
- CVE-2017-8759 – Sept 2017
- FinFisher
- FinSpy Malware
- UNITEDRAKE
- Wingbird
Sources
- MITRE ATT&CK attack.mitre.org
- ETDA Threat Group Card apt.etda.or.th
- Malpedia malpedia.caad.fkie.fraunhofer.de