Cyber Threat Actor: Sharpboys

Sharpboys is a threat actor tracked under that alias and has been associated with Iran based on the location information supplied. The group gained visibility after compromising the Facebook account of Israeli Prime Minister Benjamin Netanyahu. During the compromise, Sharpboys broadcast audio content in Arabic and Persian on the account before the material was taken down. The actors asserted that they had obtained data from the servers of the Israeli Atid group, an educational organization. They released a file comprising roughly 200,000 records that included names, identity numbers, and residential addresses. In addition to the database, Sharpboys made public other personal documents allegedly taken from Atid group systems. The Atid group stated that individuals from hostile countries had attempted strategic attacks on leading educational institutions in Israel. Consequently, the observed activity involved a government‑linked social media account and an educational sector target.

The source does not detail any specific malware families, exploit tools, or initial access vectors employed by Sharpboys in this operation. Likewise, no information is provided about their command‑and‑control infrastructure, preferred delivery mechanisms, or tooling style. Attribution beyond the geographic hint of Iran is not explicitly stated in the reporting, and no state sponsorship or criminal‑affiliation links are cited. The Netanyahu Facebook takeover and the subsequent disclosure of Atid group data represent the most prominent campaign publicly attributed to Sharpboys. This incident combined a social‑media account breach, data exfiltration, and the public release of the stolen information. No further operations or historical activity are described in the available material, so the profile is limited to this single observed event.