Sharpboys

Profile narrative

Sharpboys is a threat actor that operates under the alias Sharpboys and has been publicly linked to Iran. The group first came to attention in April 2023 when it compromised the Facebook account of Israeli Prime Minister Benjamin Netanyahu. The intrusion occurred while Israel was marking its Independence Day, according to the reporting. During the intrusion the actors broadcast audio content in Arabic and Persian on the compromised page before the material was removed.

They also claimed to have exfiltrated a large dataset from the servers of the Israeli Atid group, publishing a file that reportedly contained 200,000 records with names, identity numbers and addresses of Israeli citizens. The Atid group described the incident as a strategic attack aimed at leading educational institutions in Israel, stating that the attempt was thwarted and that only limited information was actually leaked. These actions indicate that Sharpboys focuses on Israeli governmental and educational targets, seeking to cause disruption and to expose personal data for propaganda or intimidation purposes. The observed tactics of Sharpboys include gaining unauthorized access to social‑media accounts, using those channels to disseminate multilingual audio messages, and extracting and releasing personal databases from compromised servers.

No specific malware families or exploit tools are mentioned in the reporting, and the initial access vector appears to be the compromise of a high‑profile Facebook profile, which may have involved credential theft or session hijacking. The group’s tooling style is therefore characterized by the use of legitimate platform features for impact rather than by custom malicious code. Their operations appear to be aimed at achieving strategic disruption and information leakage rather than financial gain, as there is no reference to ransomware, fraud or monetary extortion in the available coverage. Attribution to Iran is based on the location information supplied in the threat‑actor context, although no explicit state sponsorship or criminal‑consortium ties are detailed in the source material. The Netanyahu Facebook breach and the subsequent leak of Atid group data represent the most prominent campaign publicly associated with Sharpboys to date. This operation illustrates the group’s capacity to combine social‑media hijacking with data‑exposure tactics to generate media attention and to pressure Israeli institutions.

Incidents

Attributed incidents are available to members.