BlackOasis

G00630 reports from 0 vendors

BlackOasis is a Middle Eastern threat group that is believed to be a customer of Gamma Group. The group has shown interest in prominent figures in the United Nations, as well as opposition bloggers, activists, regional news correspondents, and think tanks. A group known by Microsoft as NEODYMIUM is reportedly associated closely with BlackOasis operations, but evidence that the group names are aliases has not been identified.

Vendor aliases (1)

The same group is tracked under different names by different vendors.

Vendor	Name
OSINT	G0063

MITRE ATT&CK techniques (1)

T1027

Indicators of compromise

No IOCs extracted yet from reports naming this actor.

Report timeline

Every report in the Global Intel Library that names BlackOasis, newest first. Open any report to see the full analysis with provenance.

No reports in the Lore library name this actor yet.

Threat feed IOCs (0)

Indicators from free threat feeds (abuse.ch ThreatFox, AlienVault OTX) attributed to BlackOasis. Each row shows why it was linked and where it came from.

No feed indicators linked to this actor yet. Feeds are checked every hour.

Public research & publications (6)

Open-source reports about this actor collected from MISP Galaxy and MITRE ATT&CK.

attack.mitre.orghttps://attack.mitre.org/groups/G0063
securelist.comhttps://securelist.com/apt-trends-report-q2-2017/79332/
securelist.comhttps://securelist.com/blackoasis-apt-and-new-targeted-attacks-leveraging-zero-day-exploit/82732/
cyberscoop.comhttps://www.cyberscoop.com/middle-eastern-hacking-group-using-finfisher-malware-conduct-international-espionage/
fireeye.comhttps://www.fireeye.com/blog/threat-research/2017/09/zero-day-used-to-distribute-finspy.html
attack.mitre.orghttps://attack.mitre.org/groups/G0063/