Loading story…
Syrian activists were targeted with multiple remote access trojans, including BlackShades RAT, Xtreme RAT, and DarkComet, in campaigns linked to the Syrian Electronic Army. Reporting cited Citizen Lab findings that BlackShades was used against activists, while separate observations tied Xtreme RAT and DarkComet to related activity in Syria. The malware appeared to be rotated across campaigns, suggesting operators shifted between commodity RAT families while maintaining the same targeting focus.
One lure used a fake Skype encryption tool to disguise DarkComet, showing how social-engineering themes were paired with off-the-shelf surveillance malware to compromise victims. Publicly shared indicators included sample names, file sizes, and MD5 hashes for BlackShades, Xtreme RAT, and DarkComet specimens, underscoring how the campaigns relied on readily available RATs rather than bespoke implants to monitor and control infected systems.
Pull IOCs and campaign context straight into your stack.
4 events from the most recent confirmed update back to the earliest known activity.
In June 2012, Citizen Lab published a report stating that the Syrian Electronic Army used BlackShades RAT against activists. This added BlackShades to the malware families observed in the Syrian targeting activity.
A May 2012 reference connected XTreme RAT to targeted attacks in Syria. This indicated another malware family being used in the same broader targeting of Syrian activists.
An April 2012 TrendLabs report by Nart Villeneuve documented Dark Comet RAT being used in targeted attacks in Syria. The activity was part of campaigns aimed at Syrian targets, including activists.
Contagio published sample filenames, sizes, and MD5 hashes for BlackShades RAT, XTreme RAT, and Dark Comet specimens associated with attacks on Syrian activists. The post also noted that the attackers appeared to rotate RAT families roughly monthly.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Syrian activists were hit by a sustained surveillance campaign that combined Facebook phishing with malware-laced files masquerading as revolutionary documents and other trusted content. Electronic Frontier Foundation reporting described attackers stealing account credentials through fake login pages and deploying remote-access trojans to monitor victims, with one later campaign using the commercially available **BlackShades** malware to capture data and maintain access to compromised systems. A separate EFF report said Vietnamese activists also faced highly personalized malware operations, indicating that threat actors tailored lures and surveillance tools to specific individuals and their relationships. Taken together, the incidents showed politically motivated targeting of dissidents through social engineering, credential theft, and commodity as well as custom malware designed to spy on activists and their networks.
Jul 12, 2026
Researchers linked a cluster of hacktivist activity with medium confidence to **4BID** and associated groups including **Hakerskii Kit**, **C.A.S.**, and **Goffee**, reporting that operations have expanded beyond Russia and Belarus into **Kazakhstan, the UAE, Syria, and Egypt**. The attackers primarily obtained initial access by exploiting **ProxyShell** on vulnerable **Microsoft Exchange** servers, then installed the `fd.aspx` web shell and used custom scripts alongside legitimate remote management and monitoring tools to deepen access and persistence. Post-compromise activity included deployment of **BlackReaperRAT**, **Warp RAT**, **Sliver**, **Havoc**, **Mythic Apollo**, **AdaptixC2**, and a newly documented **BlackSalt** backdoor, as well as utilities such as **AnyDesk**, **Panorama9**, **Dev Tunnels**, **Tactical RMM**, and **Nezha Monitoring**. Investigators also observed **EDR killers**, **ClearWater ransomware**, and an updated **Blackout Locker** variant, indicating that the campaigns have evolved from primarily politically motivated disruption into broader operations with a stronger **financially motivated** component.
Jul 1, 2026
Kaspersky reported that several interconnected pro-Ukrainian hacktivist groups, including **4BID**, **Hacker kiт**, **C.A.S**, and **Goffee**, expanded attacks beyond Russia and Belarus to targets in **Kazakhstan, the UAE, Syria, and Egypt**. Victims included government entities, healthcare organizations, and the aviation sector. Researchers said the intrusions commonly began with exploitation of Microsoft Exchange **ProxyShell** vulnerabilities, followed by deployment of the `fd.aspx` ASP.NET web shell, execution of PowerShell or `cmd.exe`, reconnaissance, and installation of remote-management tools such as AnyDesk, Dev Tunnels, Panorama9, Tactical RMM, and Nezha Monitoring. The campaigns used a broad post-compromise toolkit that mixed public C2 frameworks and custom malware, including **Sliver**, **Havoc**, **Mythic Apollo**, **AdaptixC2**, **BlackSalt** backdoor, **Warp RAT**, **BlackReaperRAT**, **ClearWater** ransomware, and an updated **Blackout Locker**. Investigators also observed BYOVD-based EDR killers, including modified EDRKiller variants and GhostDriver, along with signs that some delivery scripts may have been AI-generated. ClearWater was seen encrypting files with **ChaCha20** and **RSA-2048**, dropping ransom notes, changing wallpapers, and deleting recovery artifacts, while Blackout Locker added a persistent screen-locking feature, reinforcing researchers' assessment that the actors are shifting from politically branded hacktivism toward financially motivated operations.
Jun 29, 2026