File · BlackOasis · Unknown · misp-galaxy + mitre-attack · refreshed 2026-10-06
attack rose · 1 techniques across 1 tactics
What changed
ledger · newest first- —todaynew CVE5 new CVEs: CVE-2015-5119, CVE-2016-0984, CVE-2016-4117, CVE-2017-11292, CVE-2017-8759
Analyst brief
misp-galaxy + mitre-attackBlackOasis is a Middle Eastern threat group that is believed to be a customer of Gamma Group. The group has shown interest in prominent figures in the United Nations, as well as opposition bloggers, activists, regional news correspondents, and think tanks. A group known by Microsoft as NEODYMIUM is reportedly associated closely with BlackOasis operations, but evidence that the group names are aliases has not been identified.
Kill chain
MITRE ATT&CK Enterprise · tap a technique1 techniques · 1 of 15 tactics
Stealth
1 technique
select a technique
CVEs cited sources tie to BlackOasis
none on KEV- CVE-2015-51192026-10-17
“We have previously reported on BlackOasis using other zero-days in the past; CVE-2016-4117 in May 2016, CVE-2016-0984 in June 2015, and CVE-2015-5119 in June 2015.”
cited as exploiting · source: securelist.com ↗ · 2026-10-17
“we identified two other similar exploit chains used by BlackOasis in June 2015 which were zero days at the time. Those include CVE-2015-5119 and CVE-2016-0984”
cited as exploiting · source: securelist.com ↗ · 2026-10-17
- CVE-2016-09842026-10-17
“We have previously reported on BlackOasis using other zero-days in the past; CVE-2016-4117 in May 2016, CVE-2016-0984 in June 2015, and CVE-2015-5119 in June 2015.”
cited as exploiting · source: securelist.com ↗ · 2026-10-17
“we identified two other similar exploit chains used by BlackOasis in June 2015 which were zero days at the time. Those include CVE-2015-5119 and CVE-2016-0984”
cited as exploiting · source: securelist.com ↗ · 2026-10-17
- CVE-2016-41172026-10-17
“We have previously reported on BlackOasis using other zero-days in the past; CVE-2016-4117 in May 2016, CVE-2016-0984 in June 2015, and CVE-2015-5119 in June 2015.”
cited as exploiting · source: securelist.com ↗ · 2026-10-17
“Kaspersky found the group was exploiting a Adobe Flash Player zero-day vulnerability ( CVE-2016-4117 ) to remotely deliver the latest version of “FinSpy” malware, according to a new blog post published Monday.”
cited as exploiting · named nearby · source: cyberscoop.com ↗ · 2026-10-17
“CVE-2016-4117 – May 2016”
cited as exploiting · named nearby · source: securelist.com ↗ · 2026-10-17
- CVE-2017-87592026-10-17
“We are also highly confident that BlackOasis was also responsible for another zero day exploit (CVE-2017-8759) discovered by FireEye in September 2017.”
attributed by a report · source: securelist.com ↗ · 2026-10-17
- CVE-2017-112922026-10-17
“CVE-2017-11292 – Oct 2017”
cited as exploiting · named nearby · source: securelist.com ↗ · 2026-10-17
Each line is what a source says, quoted, with the source linked under it. A citation is a source's claim, not our confirmation: read the source before you act on it.
Primary-source reports
via APTnotes · linked, never re-hostedTake it with you
keyless · no signupReferences
6 sources- 1.securelist.com/blackoasis-apt-and-new-targeted-attacks-leveraging-zer…
- 2.fireeye.com/blog/threat-research/2017/09/zero-day-used-to-distribu…
- 3.attack.mitre.org/groups/G0063
- 4.attack.mitre.org/groups/G0063
- 5.securelist.com/apt-trends-report-q2-2017/79332
- 6.cyberscoop.com/middle-eastern-hacking-group-using-finfisher-malware-c…
Track BlackOasis on the wire.
This dossier is already data: the keyless actor API and a STIX 2.1 bundle. Mentions on the wire reach Telegram and RSS as they land.
Check your stack
Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.
Stack checkNo key. No signup.