Loading threat actor…
Black Shadow is an Iranian threat actor widely assessed to operate on behalf of Iran’s Ministry of Intelligence and Security (MOIS). The group has been linked to espionage, disruptive and destructive intrusions, data theft, and extortion activity, with operations targeting Israeli organizations as well as victims in the United States, Saudi Arabia, and Turkey. Black Shadow has also been associated with influence-oriented and psychologically coercive behavior through public leaks and Telegram-based messaging. The actor is known for high-impact operations against Israeli targets, including the 2021 breach of hosting provider CyberServe, which was accompanied by ransom demands and the public release of stolen customer data affecting multiple downstream organizations, including health-related and consumer-facing services. Black Shadow has also been tied by multiple researchers to the 2026 “Ababil of Minab” campaign, assessed as a state-linked operation masquerading as hacktivism. In that campaign, operators conducted destructive actions such as deleting SQL Server databases, wiping partitions, destroying backups, deleting virtual machines, and damaging file systems, while simultaneously exfiltrating large volumes of victim data. Operationally, Black Shadow has been associated with phishing and social-engineering campaigns used for initial access, including tailored lures aimed at Israeli individuals and organizations. Reported tradecraft includes reconnaissance and profiling of targets, credential harvesting, malware delivery, use of custom exfiltration tooling, encrypted chunked HTTPS uploads, collection from local drives and SMB shares, and staging of stolen data on attacker-controlled infrastructure. The group has demonstrated hands-on-keyboard post-compromise activity in addition to scripted automation, indicating mature post-exploitation capability. Known targeting includes government-adjacent and public-sector entities, transportation organizations, health-related institutions, higher education, media, insurance, and other private-sector organizations. Black Shadow is one of several Iranian intrusion sets publicly named in connection with campaigns seeking footholds inside Israeli networks for espionage, information gathering, damage, and influence purposes. Alias usage directly supported here includes Black Shadow; “Ababil of Minab” is better understood as a claimed persona or campaign identity linked by researchers to Black Shadow rather than a confirmed separate group.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
Attributed origin per open-source reporting.
23 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
1 malware family attributed to this actor across reporting.
2 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Iranian threat group assessed by the cited reporting as operating on behalf of MOIS and linked through infrastructure overlap to the Ababil of Minab campaign and prior phishing activity involving nefeshhope[.]com targeting IDF soldiers.
Iran-linked threat actor tied to infrastructure and activity associated with the Ababil of Minab campaign and described as operating on behalf of MOIS.
Conducted a breach and ransom operation against CyberServe, followed by the public leak of stolen customer data affecting multiple Israeli organizations and exposing sensitive personal and medical information.
Conducting phishing campaigns targeting Israeli entities and organizations to gain footholds for damage, espionage, information gathering, and influence operations.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.