blackshadow Ransomware
Tracked since Dec 18, 2021
0
victims recorded
0
in the last 30 days
1
CVEs
—
Last activity
In MITRE ATT&CK MITRE ATT&CK
Group profile: Agrius (G1030)
BlackShadow is an Iranian-linked hack-and-leak group (linked to the Agrius APT) that targeted Israeli companies including insurance firm Shirbit and hosting provider Cyberserve, leaking medical records of 290,000 patients, using extortion as a tool of geopolitical disruption rather than purely for financial gain.
Vulnerabilities cited for this group
CVEs associated with the group by ransomware.live. Records not yet published here appear without a link.
- CVE-2018-13379 Critical · 9.8 KEV Fortinet FortiOS SSL VPN Path Traversal Vulnerability
Tactics and techniques (MITRE ATT&CK)
Initial Access
T1078.002 Valid Accounts: Domain AccountsT1190 Exploit Public-Facing Application Execution
T1059.003 Command and Scripting Interpreter: Windows Command Shell Persistence
T1078.002 Valid Accounts: Domain AccountsT1505.003 Server Software Component: Web ShellT1543.003 Create or Modify System Process: Windows Service Privilege Escalation
T1078.002 Valid Accounts: Domain AccountsT1543.003 Create or Modify System Process: Windows Service Stealth
T1036 MasqueradingT1078.002 Valid Accounts: Domain AccountsT1140 Deobfuscate/Decode Files or Information Credential Access
T1003.001 OS Credential Dumping: LSASS MemoryT1003.002 OS Credential Dumping: Security Account ManagerT1110 Brute ForceT1110.003 Brute Force: Password Spraying Discovery
T1018 Remote System DiscoveryT1046 Network Service Discovery Lateral Movement
T1021.001 Remote Services: Remote Desktop ProtocolT1570 Lateral Tool Transfer Collection
T1005 Data from Local SystemT1074.001 Data Staged: Local Data StagingT1119 Automated CollectionT1560.001 Archive Collected Data: Archive via Utility Exfiltration
T1041 Exfiltration Over C2 Channel Resource Development
T1583 Acquire Infrastructure Defense Impairment
T1685 Disable or Modify Tools Victims posted on leak sites, according to ransomware.live. Victim names are not displayed. · View on ransomware.live