Loading threat actor…
SN_BlackMeta is a hacktivist threat actor known primarily for distributed denial-of-service operations. The group has been described as pro-Palestinian and has claimed attacks against organizations perceived as aligned with U.S. or Israeli interests. Reported activity includes disruptive campaigns against the Internet Archive, financial institutions in the Middle East, and alleged attacks affecting Microsoft Azure-related services. The actor’s operations are characterized by high-volume traffic flooding intended to overwhelm public-facing services and cause temporary outages. Multiple assessments note similarities between SN_BlackMeta and Anonymous Sudan in target selection, rhetoric, and operational style. Those similarities have led to speculation about a linkage, but a definitive attribution is not established here. SN_BlackMeta has been observed communicating in English, Russian, and Arabic, reinforcing its positioning within the contemporary hacktivist DDoS ecosystem. The group’s known behavior is centered on service disruption rather than data encryption or conventional ransomware activity. Available reporting supports an influence- and cause-driven profile consistent with hacktivism, with attacks aimed at visibility, pressure, and reputational impact on targets rather than financially motivated extortion as the dominant objective.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
1 distinct technique observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Conducted a DDoS attack against the Internet Archive, temporarily disrupting availability during the broader October 2024 incident series.
SN_Blackmeta is a hacktivist group known for conducting major DDoS attacks against financial institutions in the Middle East and cloud service providers like Microsoft Azure.
Claimed responsibility for the multi-day DDoS attacks against the Internet Archive.
Named hacktivist-style DDoS actor (claimed pro-Palestinian motives) assessed by Radware as potentially linked to Anonymous Sudan based on operational/rhetorical similarities; a German source describes it as a Russian group (Veliky Novgorod region) claiming no state sponsorship.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.