Blackatom is a Palestine-based cyber espionage group targeting Israeli defense software engineers via LinkedIn social engineering.
Analyst brief
Blackatom is a Palestine-based nation-state actor, likely linked to Hamas, engaged in cyber espionage. It targets software engineers within Israel's military, defense, and transportation sectors. Key TTPs include intricate social engineering via LinkedIn, posing as recruiters to deploy malware and steal session cookies. Defenders should focus on detecting recruitment-themed phishing, enforcing multi-factor authentication, and monitoring for anomalous authentication attempts.
Blackatom
nation-state
Recent campaigns suggest Hamas-linked actors may be advancing their
TTPs to include intricate social engineering lures specially crafted to
appeal to a niche group of high value targets. In September 2023, a Palestine-based group likely linked to Hamas targeted Israeli software engineers
using an elaborate social engineering ruse that ultimately installed malware
and stole cookies. The attackers, which Google’s Threat Analysis Group (TAG) tracks as BLACKATOM, posed as employees of legitimate companies
and reached out via LinkedIn to invite targets to apply for software development freelance opportunities. Targets included software engineers in
the Israeli military, as well as Israel’s aerospace and defense industry
origin (suspected)
🇵🇸Palestine· state-sponsoredattribution confidence: medium (50)