Blackshadow
- First seen
- 2020-10-01 00:00:00
- Malware type
- ransomware
- Family
- Malware family
- Profile updated
- 2026-07-07 13:49:05
Targeted industries: technology-and-telecommunications retail-and-hospitality media-and-entertainment
Targeted regions: country_code:il
Context
BlackShadow is a state-aligned cybercrime group reportedly linked to Iran’s cyber operations, first identified in late 2020. Their operations blend data exfiltration with ransom threats, notably targeting Israeli organizations such as Cyberserve—a web hosting provider—and leaking data to inflict reputational damage. Victims included entities like Atraf (an LGBTQ dating app), tour booking services, and museums, reflecting political or ideological motivations over financial gain. Despite carrying out extortion, there is no evidence that BlackShadow employs typical encryption-based ransomware mechanics; instead, they leverage stolen data and the threat of public exposure.
Reports & references
- ransomlook.io — Blackshadow (report)
- cyberscoop.com — Hack And Leak Group Black Shadow Keeps Targeting Israeli Victims (report)
- heimdalsecurity.com — Cyberserve Hijacked By Blackshadow Hacker Group To Extort Customers (report)