- Category
- State · Attributed to a state or working for one.
- Origin
- Israel(high confidence)
- Sources
- 5 sources carry it
- Identifier
- GINC-APT-0384 · blue-tsunami
What it is
Blue Tsunami, also known as Black Cube, is a cyber mercenary group associated with the private intelligence firm Black Cube. They target individuals in various industries, including human rights, finance, and consulting. Blue Tsunami engages in social engineering and uses techniques such as honeypot profiles, fake jobs, and fake companies to gather human intelligence for their clients. LinkedIn and Microsoft recently took down numerous fake accounts and company pages linked to Blue Tsunami.
Names
The names each vendor, agency and source gives it. Naming differs by who tracks the actor, so one group carries many.
- Other names
- Black Cube
Attribution
Each attribution is a claim: who makes it, and to whom. Western and Eastern sources are kept apart, as they often disagree.
Western sources
- MISP Galaxy (CFR tagging)Israel
- MicrosoftIsrael
- ThreatActor.info (Malpedia et al.)Israel
Tools
The tools and malware families the sources tie to it.
- BLACKCOFFEE
- BlackEnergy
- BlackHole
- BlackNix
- Blackshades
- Blue Banana
- Client Maximus
- ClientMesh
- Cyber Eye RAT
- CyberGate
Sources
- Malpedia malpedia.caad.fkie.fraunhofer.de