BlackOasis

Executive Summary

BlackOasis is a Middle Eastern threat group linked to Gamma Group, targeting NGOs, media organizations, and prominent figures for espionage. Their operations focus on data collection and influence activities, particularly in regions with high political tensions.

Goals & Targeting

BlackOasis aims for espionage, targeting sectors like NGOs and media in countries such as Russia, UK, Iran, and Saudi Arabia. The targeting of politically active individuals suggests a desire to influence regional dynamics by gathering sensitive information.

BlackOasis operates primarily in the Middle East, targeting NGOs, UN officials, activists, bloggers, news correspondents, and think tanks. They are associated with Gamma Group, known for selling spyware, but no confirmed aliases exist between BlackOasis and Microsoft's NEODYMIUM group. Their activities involve espionage to gather intelligence on opposition groups.

Key Capabilities

• Espionage using Gamma Group tools
• Phishing attacks
• Malware deployment

MITRE ATT&CK Tactics

ATT&CK Techniques

Campaigns & Victims

BlackOasis likely engages in long-term operations targeting sensitive regions, using APT tactics to infiltrate and exfiltrate data from targeted organizations.

IOC Patterns

• Spear-phishing emails
• Obfuscated files

Recommended Actions

• Enhance email filtering
• Monitor for Gamma Group tools
• Conduct regular threat hunting

Suggested Tags