Also known as: tracked as, Professor X, Abyss
Known victims: 5
Objectives
Targeted Sectors
Targeted Countries / Regions
Executive Summary
Black X is a medium-sophisticated criminal threat actor specializing in ransomware attacks with a primary focus on financial gain. Known for targeting various sectors including healthcare, legal, and IT through campaigns such as Daechang Solution and Wonjin Plastic Surgery, Black X poses an ongoing risk to organizations globally. With recent activity tracked up to July 2026, they continue to adapt their strategies to maximize disruption and financial extraction.
Goals & Targeting
Black X targets various sectors to maximize victim diversity and potential financial gain. Their strategic approach suggests they focus on industries with high payout potential and vulnerability to disruption. The selection of specific entities within these sectors indicates a tactical method to ensure successful ransom demands, aligning with their objective of organizational-gain and financial extraction.
Enhanced Description
Black X operates as a cybercriminal group primarily motivated by financial gain, employing ransomware as their main tool for extortion. Their campaigns have targeted diverse sectors such as healthcare, legal services, and IT, indicating strategic selection of vulnerable organizations regardless of geographical boundaries. The threat actor has demonstrated adaptability in attack methods, shifting from traditional ransomware to more persistent operations, including data theft and prolonged internal network diffusion.
Key Capabilities
MITRE ATT&CK Tactics
ATT&CK Techniques
Software / Tooling
Campaigns & Victims
Black X's campaigns, including 'Daechang Solution' and 'Wonjin Plastic Surgery', exhibit targeted attacks across sectors. Their operational tempo suggests a shift towards prolonged internal network diffusion, indicating evolving tactics beyond initial ransom demands to include data theft.
IOC Patterns
Recommended Actions
Suggested Tags
Confidence Assessment
Moderate confidence in Black X's identity and TTPs, with limited details on specific tools or attack lifecycle. Campaign data suggests varied targeting but lacks comprehensive insights into their operational tactics beyond what is observed.
No observed data linked yet.
4
Techniques
32
Tools
8
Campaigns
40
IOCs
0
Observed Data
2
Tactics