BladeHawk
BladeHawk is a threat actor name adopted by ESET from prior QiAnXin Threat Intelligence Center reporting for a targeted Android espionage campaign against the Kurdish ethnic group. The activity has been active since at least March 2020 and used dedicated Facebook profiles and pro-Kurd Facebook groups to distribute Android backdoors disguised as legitimate applications. Reported malware used by BladeHawk includes 888 RAT and SpyNote, with both publicly disclosed campaigns distributed via Facebook and all malware samples using the same command-and-control servers. ESET identified six Facebook profiles involved in the campaign; two targeted tech users and four posed as supporters of the Kurds. The operation used at least 28 malicious Facebook posts and 17 unique APKs, with observed downloads from hosted apps totaling at least 1,481 in one measured subset. The group’s tooling provided extensive surveillance capability. 888 RAT could steal and delete files, take screenshots, obtain device location, phish Facebook credentials, list installed apps, steal photos, take pictures, record ambient audio and phone calls, make calls, steal SMS messages, steal contacts, and send text messages. ESET also observed one attempt to steal Snapchat credentials through a phishing website. The malware masqueraded as legitimate Android applications and was promoted through fake app descriptions and download links. The campaign targeted Android users. The content also notes that Android 888 RAT associated with BladeHawk has been referred to as Gaza007 by BladeHawk. BladeHawk is mentioned as one of several groups that have targeted the Kurdish community. No nation-state attribution is directly established in the provided content.
Know when an actor pivots toward your sector
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Targeting
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Who they target
Sectors the actor has been observed targeting.
- Telecommunication Services
- Media & Entertainment
- Government & Administration
- Military
Where they target
Geographies tied to known operations.
- 🇹🇷 Türkiye
- 🇳🇱 Netherlands
Associated malware families
2 malware families attributed to this actor across reporting.
Observables
45 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
Recent activity
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Previously targeted the Kurdish community.
Mobile espionage campaign targeting the Kurdish ethnic group via Facebook-distributed Android spyware disguised as legitimate apps, primarily using 888 RAT and also SpyNote.
The version that knows your environment.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.