Black Shadow
Black Shadow is an Iranian threat group assessed to operate on behalf of Iran’s Ministry of Intelligence and Security (MOIS). Supporting content links Black Shadow to multiple operations against Israeli and other regional targets, and later reporting ties infrastructure associated with the 2026 Ababil of Minab campaign to Black Shadow with high confidence, although Hunt.io stated it did not independently verify that attribution. ClearSky Cyber Security, researcher Simon Kenin, and prior attribution referenced by the Israeli National Cyber Directorate also linked related infrastructure to Black Shadow. The group is associated with destructive and extortion-linked activity as well as espionage-oriented intrusions and phishing. In October 2021, Black Shadow was identified as the group that breached and ransomed the Israeli hosting provider CyberServe and then publicly leaked substantial volumes of customer data. Affected organizations included the Atraf dating site and the Machon Mor medical institute, with leaked data including relationship information, medical data, email addresses, and plaintext passwords. Content also places Black Shadow among Iranian groups involved in large-scale phishing and social-engineering campaigns targeting Israel’s public and private sectors. INCD reported at least 15 campaigns from Iranian groups including Black Shadow and MuddyWater, using tailored lures such as fake Rafael job offers on LinkedIn, spoofed INCD security-update emails, cash-offer scams, and academic conference invitations with malicious links. INCD assessed these campaigns as initial-access operations intended to gain footholds in organizations and support damage, espionage, information gathering, and influence activity. In 2026, Gambit Security attributed the Ababil of Minab activity with high confidence to Black Shadow. That campaign involved destructive intrusions and data theft affecting organizations in the United States, Israel, Saudi Arabia, and Turkey, including the Los Angeles County Metropolitan Transportation Authority, the South Florida Regional Transportation Authority, UNIMAC, Vyncs, Ruppin Academic Center, Ifat Media Group, courier.co.il, bac.org.il, and adabroker.com.tr. Reported tactics included SQL Server deletion, virtual machine deletion, partition wiping, backup destruction, file-system damage, and systematic exfiltration. Supporting reporting described use of a custom Flask-based encrypted upload receiver, a bespoke exfiltration tool called FileFiend, SCP and multi-part archive staging, and infrastructure overlap with nefeshhope[.]com, a fake trauma-support portal previously used to target IDF soldiers. Known alias in the provided content: black_shadow.
Know when an actor pivots toward your sector
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Targeting
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Who they target
Sectors the actor has been observed targeting.
- Transportation
- Consumer Services
- Financial Services
- Media & Entertainment
- Academia & Research
Where they target
Geographies tied to known operations.
- 🇺🇸 United States
- 🇸🇦 Saudi Arabia
- 🇮🇱 Israel
- 🇹🇷 Türkiye
Where they're from
Attributed origin per open-source reporting.
- IR
Tradecraft
22 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
Associated malware families
1 malware family attributed to this actor across reporting.
Observables
2 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
Recent activity
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Iranian threat group assessed by the cited reporting as operating on behalf of MOIS and linked through infrastructure overlap to the Ababil of Minab campaign and prior phishing activity involving nefeshhope[.]com targeting IDF soldiers.
Iran-linked threat actor tied to infrastructure and activity associated with the Ababil of Minab campaign and described as operating on behalf of MOIS.
Conducted a breach and ransom operation against CyberServe, followed by the public leak of stolen customer data affecting multiple Israeli organizations and exposing sensitive personal and medical information.
Conducting phishing campaigns targeting Israeli entities and organizations to gain footholds for damage, espionage, information gathering, and influence operations.
The version that knows your environment.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.