auren-research/cyber-sec huggingface dataset:
type: intrusion-set
spec_version: 2.1
id: intrusion-set--7251b44b-6072-476c-b8d9-a6e32c355b28
created: 2023-09-25T18:11:05.672Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/groups/G1019
external_id: G1019
source_name: MoustachedBouncer ESET August 2023
description: Faou, M. (2023, August 10). MoustachedBouncer: Espionage against foreign diplomats in Belarus. Retrieved September 25, 2023.
url: https://www.welivesecurity.com/en/eset-research/moustachedbouncer-espionage-against-foreign-diplomats-in-belarus/
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-04-16T20:37:40.255Z
name: MoustachedBouncer
description: [MoustachedBouncer](https://attack.mitre.org/groups/G1019) is a cyberespionage group that has been active since at least 2014 targeting foreign embassies in Belarus.(Citation: MoustachedBouncer ESET August 2023)
aliases: MoustachedBouncer
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
mobile-attack
x_mitre_version: 1.0
x_mitre_attack_spec_version: 3.2.0
modified: 2024-11-17T12:44:07.637Z
name: CopyKittens
description: [CopyKittens](https://attack.mitre.org/groups/G0052) is an Iranian cyber espionage group that has been operating since at least 2013. It has targeted countries including Israel, Saudi Arabia, Turkey, the U.S., Jordan, and Germany. The group is responsible for the campaign known as Operation Wilted Tulip.(Citation: ClearSky CopyKittens March 2017)(Citation: ClearSky Wilted Tulip July 2017)(Citation: CopyKittens Nov 2015)
aliases: CopyKittens
x_mitre_deprecated: no
x_mitre_version: 1.6
type: intrusion-set
spec_version: 2.1
id: intrusion-set--dcd81c6e-ebf7-4a16-93e0-9a97fa49c88a
created: 2018-01-16T16:13:52.465Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/groups/G0052
external_id: G0052
source_name: CopyKittens
description: (Citation: ClearSky CopyKittens March 2017) (Citation: ClearSky Wilted Tulip July 2017) (Citation: CopyKittens Nov 2015)
source_name: ClearSky Wilted Tulip July 2017
description: ClearSky Cyber Security and Trend Micro. (2017, July). Operation Wilted Tulip: Exposing a cyber espionage apparatus. Retrieved August 21, 2017.
url: http://www.clearskysec.com/wp-content/uploads/2017/07/Operation_Wilted_Tulip.pdf
source_name: ClearSky CopyKittens March 2017
description: ClearSky Cyber Security. (2017, March 30). Jerusalem Post and other Israeli websites compromised by Iranian threat agent CopyKitten. Retrieved August 21, 2017.
url: http://www.clearskysec.com/copykitten-jpost/
source_name: CopyKittens Nov 2015
description: Minerva Labs LTD and ClearSky Cyber Security. (2015, November 23). CopyKittens Attack Group. Retrieved November 17, 2024.
url: https://cdn2.hubspot.net/hubfs/1903456/Whitepapers/CopyKittens.pdf
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_domains: enterprise-attack
x_mitre_attack_spec_version: 3.2.0
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
type: intrusion-set
spec_version: 2.1
id: intrusion-set--9b36c218-4d80-4ec6-a68d-cc2886bbe410
created: 2024-06-14T18:17:18.727Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/groups/G1033
external_id: G1033
source_name: Callisto Group
description: (Citation: CISA Star Blizzard Advisory December 2023)
source_name: TA446
description: (Citation: CISA Star Blizzard Advisory December 2023)
source_name: COLDRIVER
description: (Citation: Google TAG COLDRIVER January 2024)
source_name: SEABORGIUM
description: (Citation: Microsoft Star Blizzard August 2022)
source_name: CISA Star Blizzard Advisory December 2023
description: CISA, et al. (2023, December 7). Russian FSB Cyber Actor Star Blizzard Continues Worldwide Spear-phishing Campaigns. Retrieved June 13, 2024.
url: https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-341a
source_name: Microsoft Star Blizzard August 2022
description: Microsoft Threat Intelligence. (2022, August 15). Disrupting SEABORGIUM’s ongoing phishing operations. Retrieved June 13, 2024.
url: https://www.microsoft.com/en-us/security/blog/2022/08/15/disrupting-seaborgiums-ongoing-phishing-operations/
source_name: StarBlizzard
description: Microsoft Threat Intelligence. (2023, December 7). Star Blizzard increases sophistication and evasion in ongoing attacks. Retrieved February 13, 2024.
url: https://www.microsoft.com/en-us/security/blog/2023/12/07/star-blizzard-increases-sophistication-and-evasion-in-ongoing-attacks/
source_name: Google TAG COLDRIVER January 2024
description: Shields, W. (2024, January 18). Russian threat group COLDRIVER expands its targeting of Western officials to include the use of malware. Retrieved June 13, 2024.
url: https://blog.google/threat-analysis-group/google-tag-coldriver-russian-phishing-malware/
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-10-22T22:12:56.172Z
name: Star Blizzard
description: [Star Blizzard](https://attack.mitre.org/groups/G1033) is a cyber espionage and influence group originating in Russia that has been active since at least 2019. [Star Blizzard](https://attack.mitre.org/groups/G1033) campaigns align closely with Russian state interests and have included persistent phishing and credential theft against academic, defense, government, NGO, and think tank organizations in NATO countries, particularly the US and the UK.(Citation: Microsoft Star Blizzard August 2022)(Citation: CISA Star Blizzard Advisory December 2023)(Citation: StarBlizzard)(Citation: Google TAG COLDRIVER January 2024)

aliases: Star Blizzard
SEABORGIUM
Callisto Group
TA446
COLDRIVER
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_deprecated: no
x_mitre_version: 2.0
x_mitre_attack_spec_version: 3.3.0
x_mitre_contributors: Aung Kyaw Min Naing, @Nolan
x_mitre_domains: enterprise-attack
mobile-attack
type: intrusion-set
spec_version: 2.1
id: intrusion-set--d69e568e-9ac8-4c08-b32c-d93b43ba9172
created: 2018-10-17T00:14:20.652Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
external_references: source_name: mitre-attack
url: https://attack.mitre.org/groups/G0076
external_id: G0076
source_name: Thrip
description: (Citation: Symantec Thrip June 2018)
source_name: Symantec Thrip June 2018
description: Security Response Attack Investigation Team. (2018, June 19). Thrip: Espionage Group Hits Satellite, Telecoms, and Defense Companies. Retrieved July 10, 2018.
url: https://www.symantec.com/blogs/threat-intelligence/thrip-hits-satellite-telecoms-defense-targets
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-04-25T14:49:36.307Z
name: Thrip
description: [Thrip](https://attack.mitre.org/groups/G0076) is an espionage group that has targeted satellite communications, telecoms, and defense contractor companies in the U.S. and Southeast Asia. The group uses custom malware as well as "living off the land" techniques. (Citation: Symantec Thrip June 2018)
aliases: Thrip
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_version: 1.2
x_mitre_attack_spec_version: 3.2.0
modified: 2023-09-29T18:06:43.110Z
name: C0026
description: [C0026](https://attack.mitre.org/campaigns/C0026) was a campaign identified in September 2022 that included the selective distribution of [KOPILUWAK](https://attack.mitre.org/software/S1075) and [QUIETCANARY](https://attack.mitre.org/software/S1076) malware to previous [ANDROMEDA](https://attack.mitre.org/software/S1074) malware victims in Ukraine through re-registered [ANDROMEDA](https://attack.mitre.org/software/S1074) C2 domains. Several tools and tactics used during [C0026](https://attack.mitre.org/campaigns/C0026) were consistent with historic [Turla](https://attack.mitre.org/groups/G0010) operations.(Citation: Mandiant Suspected Turla Campaign February 2023)
aliases: C0026
first_seen: 2022-08-01T05:00:00.000Z
last_seen: 2022-09-01T04:00:00.000Z
x_mitre_first_seen_citation: (Citation: Mandiant Suspected Turla Campaign February 2023)
x_mitre_last_seen_citation: (Citation: Mandiant Suspected Turla Campaign February 2023)
x_mitre_deprecated: no
x_mitre_version: 1.0
x_mitre_contributors: Yoshihiro Kori, NEC Corporation
Manikantan Srinivasan, NEC Corporation India
Pooja Natarajan, NEC Corporation India
type: campaign
spec_version: 2.1
id: campaign--c89fa3ff-4773-4daf-8aec-d8f43f10116e
created: 2023-05-15T19:17:48.880Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/campaigns/C0026
external_id: C0026
source_name: Mandiant Suspected Turla Campaign February 2023
description: Hawley, S. et al. (2023, February 2). Turla: A Galaxy of Opportunity. Retrieved May 15, 2023.
url: https://www.mandiant.com/resources/blog/turla-galaxy-opportunity
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_attack_spec_version: 3.2.0
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_domains: enterprise-attack
type: intrusion-set
spec_version: 2.1
id: intrusion-set--7a0d4c09-dfe7-4fa2-965a-1a0e42fedd70
created: 2019-02-05T17:56:55.233Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: yes
external_references: source_name: mitre-attack
url: https://attack.mitre.org/groups/G0086
external_id: G0086
source_name: Stolen Pencil
description: (Citation: Netscout Stolen Pencil Dec 2018)
source_name: Netscout Stolen Pencil Dec 2018
description: ASERT team. (2018, December 5). STOLEN PENCIL Campaign Targets Academia. Retrieved February 5, 2019.
url: https://asert.arbornetworks.com/stolen-pencil-campaign-targets-academia/
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-04-25T14:49:37.027Z
name: Stolen Pencil
description: [Stolen Pencil](https://attack.mitre.org/groups/G0086) is a threat group likely originating from DPRK that has been active since at least May 2018. The group appears to have targeted academic institutions, but its motives remain unclear.(Citation: Netscout Stolen Pencil Dec 2018)
aliases: Stolen Pencil
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_version: 1.1
x_mitre_attack_spec_version: 3.2.0
modified: 2024-04-19T19:35:15.637Z
name: PROMETHIUM
description: [PROMETHIUM](https://attack.mitre.org/groups/G0056) is an activity group focused on espionage that has been active since at least 2012. The group has conducted operations globally with a heavy emphasis on Turkish targets. [PROMETHIUM](https://attack.mitre.org/groups/G0056) has demonstrated similarity to another activity group called [NEODYMIUM](https://attack.mitre.org/groups/G0055) due to overlapping victim and campaign characteristics.(Citation: Microsoft NEODYMIUM Dec 2016)(Citation: Microsoft SIR Vol 21)(Citation: Talos Promethium June 2020)
aliases: PROMETHIUM
StrongPity
x_mitre_deprecated: no
x_mitre_version: 2.1
type: intrusion-set
spec_version: 2.1
id: intrusion-set--efed95ba-d7e8-47ff-8c53-99c42426ee7c
created: 2018-01-16T16:13:52.465Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/groups/G0056
external_id: G0056
source_name: PROMETHIUM
description: (Citation: Microsoft NEODYMIUM Dec 2016) (Citation: Microsoft SIR Vol 21)
source_name: Microsoft SIR Vol 21
description: Anthe, C. et al. (2016, December 14). Microsoft Security Intelligence Report Volume 21. Retrieved November 27, 2017.
url: http://download.microsoft.com/download/E/B/0/EB0F50CC-989C-4B66-B7F6-68CD3DC90DE3/Microsoft_Security_Intelligence_Report_Volume_21_English.pdf
source_name: Talos Promethium June 2020
description: Mercer, W. et al. (2020, June 29). PROMETHIUM extends global reach with StrongPity3 APT. Retrieved July 20, 2020.
url: https://blog.talosintelligence.com/2020/06/promethium-extends-with-strongpity3.html
source_name: Microsoft NEODYMIUM Dec 2016
description: Microsoft. (2016, December 14). Twin zero-day attacks: PROMETHIUM and NEODYMIUM target individuals in Europe. Retrieved November 27, 2017.
url: https://blogs.technet.microsoft.com/mmpc/2016/12/14/twin-zero-day-attacks-promethium-and-neodymium-target-individuals-in-europe/
source_name: StrongPity
description: The name StrongPity has also been used to describe the group and the malware used by the group.(Citation: Bitdefender StrongPity June 2020)(Citation: Talos Promethium June 2020)
source_name: Bitdefender StrongPity June 2020
description: Tudorica, R. et al. (2020, June 30). StrongPity APT - Revealing Trojanized Tools, Working Hours and Infrastructure. Retrieved July 20, 2020.
url: https://www.bitdefender.com/files/News/CaseStudies/study/353/Bitdefender-Whitepaper-StrongPity-APT.pdf
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_domains: enterprise-attack
x_mitre_attack_spec_version: 3.2.0
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
type: intrusion-set
spec_version: 2.1
id: intrusion-set--0ea72cd5-ca30-46ba-bc04-378f701c658f
created: 2017-05-31T21:32:05.611Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
external_references: source_name: mitre-attack
url: https://attack.mitre.org/groups/G0036
external_id: G0036
source_name: GCMAN
description: (Citation: Securelist GCMAN)
source_name: Securelist GCMAN
description: Kaspersky Lab's Global Research & Analysis Team. (2016, February 8). APT-style bank robberies increase with Metel, GCMAN and Carbanak 2.0 attacks. Retrieved April 20, 2016.
url: https://securelist.com/apt-style-bank-robberies-increase-with-metel-gcman-and-carbanak-2-0-attacks/73638/
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-04-25T14:49:37.572Z
name: GCMAN
description: [GCMAN](https://attack.mitre.org/groups/G0036) is a threat group that focuses on targeting banks for the purpose of transferring money to e-currency services. (Citation: Securelist GCMAN)
aliases: GCMAN
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_version: 1.1
x_mitre_attack_spec_version: 3.2.0
type: intrusion-set
spec_version: 2.1
id: intrusion-set--6566aac9-dad8-4332-ae73-20c23bad7f02
created: 2021-09-28T17:41:12.950Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
external_references: source_name: mitre-attack
url: https://attack.mitre.org/groups/G0137
external_id: G0137
source_name: Kaspersky Ferocious Kitten Jun 2021
description: GReAT. (2021, June 16). Ferocious Kitten: 6 Years of Covert Surveillance in Iran. Retrieved September 22, 2021.
url: https://securelist.com/ferocious-kitten-6-years-of-covert-surveillance-in-iran/102806/
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-04-25T14:49:38.455Z
name: Ferocious Kitten
description: [Ferocious Kitten](https://attack.mitre.org/groups/G0137) is a threat group that has primarily targeted Persian-speaking individuals in Iran since at least 2015.(Citation: Kaspersky Ferocious Kitten Jun 2021)
aliases: Ferocious Kitten
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_version: 1.0
x_mitre_attack_spec_version: 3.2.0
x_mitre_contributors: Pooja Natarajan, NEC Corporation India
Manikantan Srinivasan, NEC Corporation India
Hiroki Nagahama, NEC Corporation
type: intrusion-set
spec_version: 2.1
id: intrusion-set--fe98767f-9df8-42b9-83c9-004b1dec8647
created: 2017-05-31T21:31:50.198Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
external_references: source_name: mitre-attack
url: https://attack.mitre.org/groups/G0011
external_id: G0011
source_name: PittyTiger
description: (Citation: Bizeul 2014) (Citation: Villeneuve 2014)
source_name: Bizeul 2014
description: Bizeul, D., Fontarensky, I., Mouchoux, R., Perigaud, F., Pernet, C. (2014, July 11). Eye of the Tiger. Retrieved September 29, 2015.
url: https://airbus-cyber-security.com/the-eye-of-the-tiger/
source_name: Villeneuve 2014
description: Villeneuve, N., Homan, J. (2014, July 31). Spy of the Tiger. Retrieved September 29, 2015.
url: https://www.fireeye.com/blog/threat-research/2014/07/spy-of-the-tiger.html
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-04-25T14:49:38.981Z
name: PittyTiger
description: [PittyTiger](https://attack.mitre.org/groups/G0011) is a threat group believed to operate out of China that uses multiple different types of malware to maintain command and control.(Citation: Bizeul 2014)(Citation: Villeneuve 2014)
aliases: PittyTiger
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_version: 1.2
x_mitre_attack_spec_version: 3.2.0
modified: 2024-11-17T15:03:54.769Z
name: APT17
description: [APT17](https://attack.mitre.org/groups/G0025) is a China-based threat group that has conducted network intrusions against U.S. government entities, the defense industry, law firms, information technology companies, mining companies, and non-government organizations. (Citation: FireEye APT17)
aliases: APT17
Deputy Dog
x_mitre_deprecated: no
x_mitre_version: 1.1
type: intrusion-set
spec_version: 2.1
id: intrusion-set--090242d7-73fc-4738-af68-20162f7a5aae
created: 2017-05-31T21:31:57.307Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/groups/G0025
external_id: G0025
source_name: APT17
description: (Citation: FireEye APT17)
source_name: Deputy Dog
description: (Citation: FireEye APT17)
source_name: FireEye APT17
description: FireEye Labs/FireEye Threat Intelligence. (2015, May 14). Hiding in Plain Sight: FireEye and Microsoft Expose Obfuscation Tactic. Retrieved November 17, 2024.
url: https://web.archive.org/web/20240119213200/https://www2.fireeye.com/rs/fireye/images/APT17_Report.pdf
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_domains: enterprise-attack
x_mitre_attack_spec_version: 3.2.0
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
type: intrusion-set
spec_version: 2.1
id: intrusion-set--be8847e0-9512-45db-895e-f871ab6d3820
created: 2025-09-29T20:01:50.272Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/groups/G1050
external_id: G1050
source_name: GOLD FEATHER
description: (Citation: BushidoToken Qilin RaaS JUN 2024)
source_name: Sophos Qilin MSP APR 2025
description: Bradshaw, A. et al. (2025, April 1). Qilin affiliates spear-phish MSP ScreenConnect admin, targeting customers downstream. Retrieved September 26, 2025.
url: https://news.sophos.com/en-us/2025/04/01/sophos-mdr-tracks-ongoing-campaign-by-qilin-affiliates-targeting-screenconnect/
source_name: BushidoToken Qilin RaaS JUN 2024
description: Thomas, W. (2024, June 12). Tracking Adversaries: The Qilin RaaS. Retrieved September 26, 2025.
url: https://blog.bushidotoken.net/2024/06/tracking-adversaries-qilin-raas.html
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-10-23T21:52:27.774Z
name: Water Galura
description: [Water Galura](https://attack.mitre.org/groups/G1050) are the operators of the [Qilin](https://attack.mitre.org/software/S1242) Ransomware-as-a-Service (RaaS) who handle payload generation, ransom negotiations, and the publication of stolen data for [Qilin](https://attack.mitre.org/software/S1242) affilates recruited on Russian cybercrime forums. [Water Galura](https://attack.mitre.org/groups/G1050) have been active since at least 2022 and use a double extortion model where they demand payment for providing decryption keys and for refraining from publishing the stolen data to their leak site.(Citation: BushidoToken Qilin RaaS JUN 2024)(Citation: Sophos Qilin MSP APR 2025)
aliases: Water Galura
GOLD FEATHER
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_deprecated: no
x_mitre_version: 1.0
x_mitre_attack_spec_version: 3.3.0
x_mitre_domains: enterprise-attack
type: intrusion-set
spec_version: 2.1
id: intrusion-set--da49b9f1-ca99-443f-9728-0a074db66850
created: 2018-04-18T17:59:24.739Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
external_references: source_name: mitre-attack
url: https://attack.mitre.org/groups/G0063
external_id: G0063
source_name: BlackOasis
description: (Citation: Securelist BlackOasis Oct 2017) (Citation: Securelist APT Trends Q2 2017)
source_name: Securelist BlackOasis Oct 2017
description: Kaspersky Lab's Global Research & Analysis Team. (2017, October 16). BlackOasis APT and new targeted attacks leveraging zero-day exploit. Retrieved February 15, 2018.
url: https://securelist.com/blackoasis-apt-and-new-targeted-attacks-leveraging-zero-day-exploit/82732/
source_name: Securelist APT Trends Q2 2017
description: Kaspersky Lab's Global Research & Analysis Team. (2017, August 8). APT Trends report Q2 2017. Retrieved February 15, 2018.
url: https://securelist.com/apt-trends-report-q2-2017/79332/
source_name: CyberScoop BlackOasis Oct 2017
description: Bing, C. (2017, October 16). Middle Eastern hacking group is using FinFisher malware to conduct international espionage. Retrieved February 15, 2018.
url: https://www.cyberscoop.com/middle-eastern-hacking-group-using-finfisher-malware-conduct-international-espionage/
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-04-25T14:49:40.224Z
name: BlackOasis
description: [BlackOasis](https://attack.mitre.org/groups/G0063) is a Middle Eastern threat group that is believed to be a customer of Gamma Group. The group has shown interest in prominent figures in the United Nations, as well as opposition bloggers, activists, regional news correspondents, and think tanks. (Citation: Securelist BlackOasis Oct 2017) (Citation: Securelist APT Trends Q2 2017) A group known by Microsoft as [NEODYMIUM](https://attack.mitre.org/groups/G0055) is reportedly associated closely with [BlackOasis](https://attack.mitre.org/groups/G0063) operations, but evidence that the group names are aliases has not been identified. (Citation: CyberScoop BlackOasis Oct 2017)
aliases: BlackOasis
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_version: 1.0
x_mitre_attack_spec_version: 3.2.0