Loading threat actor…
BladeHawk is a mobile-focused cyberespionage threat cluster associated with targeted surveillance of the Kurdish community. Activity linked to the group has been observed since at least 2020. The actor is known for distributing Android spyware through social-media personas and posts that masquerade as Kurdish news, technology content, or pro-Kurdish material, and for luring victims into installing trojanized applications. BladeHawk has been tied to Android campaigns using the commercial malware families 888 RAT and SpyNote. In these operations, the malware was disguised as legitimate applications and promoted through Facebook profiles and pro-Kurdish groups. The tooling provided broad surveillance functionality, including theft of files, contacts, SMS messages, photos, and location data; audio and call recording; camera access; application discovery; screenshot capture; and phishing for Facebook credentials. Reported behavior also included command execution from a remote controller, use of uncommon command-and-control ports, suppression of visible application presence, and Android persistence through broadcast receivers. The group’s targeting has centered on Kurdish individuals, supporters, and communities, including audiences connected to the Kurdistan Region and Kurdish political causes. BladeHawk is notable for operational use of commodity Android surveillance tooling in a focused espionage context rather than for financially motivated crime or ransomware. The actor has also used the malware name Gaza007 for Android 888 RAT in at least one campaign. No high-confidence public attribution to a specific state or country is established in the supplied facts.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
2 malware families attributed to this actor across reporting.
45 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Previously targeted the Kurdish community.
Mobile espionage campaign targeting the Kurdish ethnic group via Facebook-distributed Android spyware disguised as legitimate apps, primarily using 888 RAT and also SpyNote.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.