Dashboard / Threat Actors / BlackOasis

BlackOasis

APT Group Information theft and espionage ETDA ✓

Also Known As 1 names

G0063

Target Countries 12

Countries highlighted in red

Afghanistan Angola Bahrain Iraq Islamic Republic of Iran Jordan Libya Nigeria Netherlands Saudi Arabia Tunisia United States

Sectors Targeted

Computer Systems Design and Related Services 54151 Media Think Tanks activists and the UN

Details

Origin Middle East

Last Updated 01 Jun 2022

MITRE ATT&CK 5

T1027 T1059.003 T1071.001 T1203 T1566.001

Related Zero-Days

No zero-day CVE linked to this actor

Known Names 2 entries

BlackOasis Kaspersky

G0063 MITRE

Observed Target Countries 13

Based on ETDA data — countries highlighted in red

Afghanistan Angola Bahrain Iran Iraq Jordan Libya Netherlands Nigeria Russia Saudi Arabia Tunisia UK

Description

BlackOasis is a Middle Eastern threat group that is believed to be a customer of Gamma Group. The group has shown interest in prominent figures in the United Nations, as well as opposition bloggers, activists, regional news correspondents, and think tanks. A group known by Microsoft as {{Neodymium}} is reportedly associated closely with BlackOasis operations, but evidence that the group names are aliases has not been identified.

Tools Used 3

FinFisher Wingbird 0-day vulnerabilities in Flash

Operations 4

2015-06 Leveraging data from Kaspersky Security Network, we identified two other similar exploit chains used by BlackOasis in June 2015 which were zero days at the time. Those include CVE-2015-5119 and CVE-2016-0984, which were patched in July 2015 and February 2016 respectively. These exploit chains also delivered FinSpy installation packages. https://securelist.com/blackoasis-apt-and-new-targeted-attacks-leveraging-zero-day-exploit/82732/

2016-05 We first became aware of BlackOasis’ activities in May 2016, while investigating another Adobe Flash zero day. On May 10, 2016, Adobe warned of a vulnerability (CVE-2016-4117) affecting Flash Player 21.0.0.226 and earlier versions for Windows, Macintosh, Linux, and Chrome OS. The vulnerability was actively being exploited in the wild.

2017-09 FireEye recently detected a malicious Microsoft Office RTF document that leveraged CVE-2017-8759, a SOAP WSDL parser code injection vulnerability. This vulnerability allows a malicious actor to inject arbitrary code during the parsing of SOAP WSDL definition contents. https://www.fireeye.com/blog/threat-research/2017/09/zero-day-used-to-distribute-finspy.html

2017-10 On October 10, 2017, Kaspersky Lab’s advanced exploit prevention systems identified a new Adobe Flash zero day exploit used in the wild against our customers. The exploit was delivered through a Microsoft Office document and the final payload was the latest version of FinSpy malware. https://securelist.com/blackoasis-apt-and-new-targeted-attacks-leveraging-zero-day-exploit/82732/

ETDA Profile

BlackOasis

Origin

[Middle East]

First Seen 2015

Motivation

Information theft and espionage

MITRE ATT&CK Groups

https://attack.mitre.org/groups/G0063/

View on ETDA APT Groups ↗