BlackJack
- Origin
- UA
- Primary motivation
- sabotage
- Sophistication
- advanced
- Resource level
- government
- Actor type
- nation-state
- Profile updated
- 2026-07-07 12:14:57
Targeted industries: energy-and-utilities government-and-public-sector technology-and-telecommunications
Targeted regions: country_code:ru
Context
Blackjack, a threat actor linked to Ukraine's security apparatus, has targeted critical Russian entities such as ISPs, utilities, and military infrastructure. They have claimed responsibility for launching cyberattacks resulting in substantial damage and data exfiltration. The group allegedly used the Fuxnet malware to target sensor gateways connected to internet-connected sensors, impacting infrastructure monitoring systems. Blackjack has also been involved in attacks against companies like Moscollector, causing disruptions and stealing sensitive data.
Reports & references
- enigmasoftware.com — Fuxneticsmalware Removal (report)
- securityweek.com — Destructive Ics Malware Fuxnet Used By Ukraine Against Russian Infrastructure (report)
- claroty.com — Unpacking The Blackjack Groups Fuxnet Malware (report)
- rewterz.com — Rewterz Threat Update Pro Ukraine Hacktivists Breach Russian Isp As Revenge For Kyivstar Attack (report)