BlackOasis is a Middle Eastern group known for targeting prominent figures using Gamma Group spyware.
BlackOasis is a Middle Eastern threat group believed to be a customer of the commercial spyware vendor Gamma Group. They primarily target prominent figures in the United Nations, opposition bloggers, activists, regional news correspondents, and think tanks. Their key TTP includes the use of obfuscated files or information (T1027) for stealth, likely leveraging commercial spyware tools from Gamma Group. Defenders should focus on monitoring for highly targeted phishing campaigns aimed at high-profile individuals and detecting indicators of file or code obfuscation.
BlackOasis is a Middle Eastern threat group that is believed to be a customer of Gamma Group. The group has shown interest in prominent figures in the United Nations, as well as opposition bloggers, activists, regional news correspondents, and think tanks. A group known by Microsoft as NEODYMIUM is reportedly associated closely with BlackOasis operations, but evidence that the group names are aliases has not been identified.
Monitor for obfuscated files or information to identify suspicious processes and implement content inspection.
BlackOasis targets prominent figures in the United Nations, opposition bloggers, activists, regional news correspondents, and think tanks. Their key technique involves the use of obfuscated files or information (T1027) for stealth.
The BlackOasis group is believed to be a customer of the commercial spyware vendor Gamma Group.
Every claim on this page is drawn from the cited source (MISP Galaxy, MITRE ATT&CK, ransomware.live) — no attribution is invented.