BlackShadow

BlackShadow operates as a cyber threat actor that conducts intrusions against Israeli‑based organizations. Its activities include gaining unauthorized access to hosting providers, exfiltrating client databases, and disrupting the online services of affected entities. In the October 2021 incident, the group stole data from a hosting company, demanded a cryptocurrency ransom, and released a sample of the stolen records to pressure victims. The attackers also exposed sensitive information from an LGBT platform, increasing the risk to individuals in conservative communities. Beyond data theft, BlackShadow’s operations have caused service outages for radio stations, museums, educational institutions, a public transportation firm, a broadcaster, a travel agency, and a children's museum.

The group is identified as Iranian state‑sponsored and is believed to carry out retaliatory operations rather than financially motivated extortion. Prior to the 2021 hosting provider breach, BlackShadow had been linked to an attack on an Israeli insurance company, indicating a pattern of targeting Israeli entities. Its distinguishing characteristics include the use of cryptocurrency demands, the public release of data samples to validate threats, and a focus on exposing personally identifiable information that could endanger specific communities. These traits set it apart from purely criminal ransomware groups and align it with geopolitically motivated cyber campaigns.

BlackShadow is described as a hacking group that operates under the alias BlackShadow. The group is headquartered in Iran. No public information indicates a parent company or subsidiary structure for the organization. Cybersecurity authorities had previously warned the hosting provider about imminent attacks, showing that the threat was anticipated. Its state backing, retaliatory motive, and observed tactics characterize its current profile in the threat landscape.