BlackJack

BlackJack is a hacktivist threat group targeting Russian entities, including industrial and critical infrastructure. Kaspersky reported overlaps between BlackJack and the previously known group Twelve, and assessed that BlackJack is part of a broader set of Russia-targeting clusters that also includes MorLock and Shedding Zmiy (ExCobalt), with shared tooling, procedures, and infrastructure complicating attribution. Kaspersky specifically identified overlaps between Twelve and BlackJack, and noted that BlackJack also used Shamoon and LockBit in attacks. BlackJack claimed responsibility for the “MOSCOLLECTOR TAKEDOWN” attack against moscollector.ru, described as Russia’s industrial sensor and monitoring infrastructure. According to the provided reporting, the operation allegedly disabled 87,000 sensors across Russian critical infrastructure, including emergency services and utilities. In that attack, BlackJack used the custom ICS/OT malware Fuxnet to manipulate and destroy OT systems and technology. Dragos likewise reported that BlackJack used custom ICS malware Fuxnet to disable 87,000 sensors in Russian critical infrastructure. Kaspersky stated that its report detailed the tools, malware, and procedures of the BlackJack group and linked it to Twelve. The content directly mentions BlackJack as a hacktivist group and ties it to destructive operations against Russian targets, with observed overlap in tooling and tradecraft with Twelve.