GINC-APT-0384 · State

Blue Tsunami

Also Black Cube.

Category
State · Attributed to a state or working for one.
Origin
Israel(high confidence)
Sources
5 sources carry it
Identifier
GINC-APT-0384 · blue-tsunami

What it is

Blue Tsunami, also known as Black Cube, is a cyber mercenary group associated with the private intelligence firm Black Cube. They target individuals in various industries, including human rights, finance, and consulting. Blue Tsunami engages in social engineering and uses techniques such as honeypot profiles, fake jobs, and fake companies to gather human intelligence for their clients. LinkedIn and Microsoft recently took down numerous fake accounts and company pages linked to Blue Tsunami.

Names

The names each vendor, agency and source gives it. Naming differs by who tracks the actor, so one group carries many.

Other names
Black Cube

Attribution

Each attribution is a claim: who makes it, and to whom. Western and Eastern sources are kept apart, as they often disagree.

Tools

The tools and malware families the sources tie to it.

  • BLACKCOFFEE
  • BlackEnergy
  • BlackHole
  • BlackNix
  • Blackshades
  • Blue Banana
  • Client Maximus
  • ClientMesh
  • Cyber Eye RAT
  • CyberGate

Sources

  • Malpedia malpedia.caad.fkie.fraunhofer.de