BlackOasis

Also known as: BlackOasis, G0063

BlackOasis is a Middle Eastern threat group that is believed to be a customer of Gamma Group. The group has shown interest in prominent figures in the United Nations, as well as opposition bloggers, activists, regional news correspondents, and think tanks. Securelist BlackOasis Oct 2017 Securelist APT Trends Q2 2017 A group known by Microsoft as NEODYMIUM is reportedly associated closely with BlackOasis operations, but evidence that the group names are aliases has not been identified. CyberScoop BlackOasis Oct 2017

🌍 Country ["[Middle East]"]
📅 Activity 2017 — 2017
🧭 ATT&CK G0063
2017
2017

Associated Operations

2015-06 2016 2016-05 2017 2017-09 2017-10 Adobe warned of a vulnerability (CVE-2016-4117) affecting Flash Player 21.0.0.226 and earlier versions for Windows FireEye recently detected a malicious Microsoft Office RTF document that leveraged CVE-2017-8759 Kaspersky Lab’s advanced exploit prevention systems identified a new Adobe Flash zero day exploit used in the wild against our customers. The exploit was delivered through a Microsoft Office document and the final payload was the latest version of FinSpy malware. Leveraging data from Kaspersky Security Network Linux Macintosh On October 10 We first became aware of BlackOasis’ activities in May 2016 a SOAP WSDL parser code injection vulnerability. This vulnerability allows a malicious actor to inject arbitrary code during the parsing of SOAP WSDL definition contents. and Chrome OS. The vulnerability was actively being exploited in the wild. https://securelist.com/blackoasis-apt-and-new-targeted-attacks-leveraging-zero-day-exploit/82732/ https://www.fireeye.com/blog/threat-research/2017/09/zero-day-used-to-distribute-finspy.html we identified two other similar exploit chains used by BlackOasis in June 2015 which were zero days at the time. Those include CVE-2015-5119 and CVE-2016-0984 which were patched in July 2015 and February 2016 respectively. These exploit chains also delivered FinSpy installation packages. while investigating another Adobe Flash zero day. On May 10

Introduction

BlackOasis is a Middle Eastern threat group that is believed to be a customer of Gamma Group. The group has shown interest in prominent figures in the United Nations, as well as opposition bloggers, activists, regional news correspondents, and think tanks. Securelist BlackOasis Oct 2017 Securelist APT Trends Q2 2017 A group known by Microsoft as NEODYMIUM is reportedly associated closely with BlackOasis operations, but evidence that the group names are aliases has not been identified. CyberScoop BlackOasis Oct 2017

Activities and Tactics

Country of Origin: 🏳️ [“[Middle East]”]

First Seen: 2017

Last Activity: 2017

Notable Campaigns

  • 2015-06
  • 2016
  • 2016-05
  • 2017
  • 2017-09
  • 2017-10
  • Adobe warned of a vulnerability (CVE-2016-4117) affecting Flash Player 21.0.0.226 and earlier versions for Windows
  • FireEye recently detected a malicious Microsoft Office RTF document that leveraged CVE-2017-8759
  • Kaspersky Lab’s advanced exploit prevention systems identified a new Adobe Flash zero day exploit used in the wild against our customers. The exploit was delivered through a Microsoft Office document and the final payload was the latest version of FinSpy malware.
  • Leveraging data from Kaspersky Security Network
  • Linux
  • Macintosh
  • On October 10
  • We first became aware of BlackOasis’ activities in May 2016
  • a SOAP WSDL parser code injection vulnerability. This vulnerability allows a malicious actor to inject arbitrary code during the parsing of SOAP WSDL definition contents.
  • and Chrome OS. The vulnerability was actively being exploited in the wild.
  • https://securelist.com/blackoasis-apt-and-new-targeted-attacks-leveraging-zero-day-exploit/82732/
  • https://www.fireeye.com/blog/threat-research/2017/09/zero-day-used-to-distribute-finspy.html
  • we identified two other similar exploit chains used by BlackOasis in June 2015 which were zero days at the time. Those include CVE-2015-5119 and CVE-2016-0984
  • which were patched in July 2015 and February 2016 respectively. These exploit chains also delivered FinSpy installation packages.
  • while investigating another Adobe Flash zero day. On May 10

Tactics, Techniques, and Procedures (TTPs)

ATT&CK technique IDs (denormalized)

Notable Indicators of Compromise (IOCs)

No atomic indicators are listed in this profile. The APTnotes snapshot indexes 1 public reports that may contain IOCs; see Source Attribution for dataset links.

Malware and Tools

  • BlackEnergy
  • BLACKCOFFEE
  • Blackshades
  • BlackNix
  • UNITEDRAKE
  • BlackHole
  • CVE-2015-5119 – June 2015:
  • CVE-2016-0984 – June 2015:
  • CVE-2016-4117 – May 2016:
  • CVE-2017-8759 – Sept 2017:
  • CVE-2017-11292 – Oct 2017:
  • FinSpy Malware:
  • 0-day vulnerabilities in Flash:
  • FinFisher:
  • Wingbird:

Attribution and Evidence

Country of Origin: [“[Middle East]”] Additional attribution information pending cataloguing.

References

[1] mitre-attack [3] Securelist BlackOasis Oct 2017 Kaspersky Lab’s Global Research & Analysis Team. (2017, October 16). BlackOasis APT and new targeted attacks leveraging zero-day exploit. Retrieved February 15, 2018. [4] Securelist APT Trends Q2 2017 Kaspersky Lab’s Global Research & Analysis Team. (2017, August 8). APT Trends report Q2 2017. Retrieved February 15, 2018. [5] CyberScoop BlackOasis Oct 2017 Bing, C. (2017, October 16). Middle Eastern hacking group is using FinFisher malware to conduct international espionage. Retrieved February 15, 2018.