­
Unveiling Iranian Cyber Aggression: Black Shadow's Ransomware Tactics By Omri Segev Moyal - All Articles - CISO Platform

Unveiling%20Iranian%20Cyber%20Aggression%20Black%20Shadows%20Ransomware%20Tactics.png?profile=RESIZE_710x

 
 

This video delves into the cyber attack orchestrated by the group Black Shadow on an Israeli insurance company, Sherbet. Despite using common hacking techniques like web shells and credential harvesting, the attack garnered attention due to the group's strategic use of media exploitation.

 

 

 

 

Here is the verbatim discussion:

 

The mainblow and the leakage of an act to a very interesting company, an insurance company in israel called Sherbet and they were attacked by a so-called group with the acronym of black shadow the main difference in this attack again nothing really fancy not any fancy tools nothing was unique it wasn't any what we used to see as an apt type of style with really sophisticated tools but very common things like web shells credentials harvesting some very normal payloads they use very simple wipers i'm not mistaken written in dotnet they use some custom trojans which we're also going to see later on they use ssh tunnels etc reverse proxy to leap to to hack the organization really a normal organization with a really you know basic security should have been able to stop them but for some reason they were not able to but the main difference here and this is why we also call it an info op but what the group here and by this time it was actually pretty obvious it was iranian a group called fox kittens uh by clear sky for example  they used telegram to lick and cause quite a panic in israel they heavily exploited the israeli media to amplify the attack and they did it in let's say in chunks so to get more atmosphere and show it was a really big hack and quite from there it was quite obvious that it's not an extortion attempt it's mainly someone trying to look at the stuff we even thought she'll be really bad but after that because some of the languages and the way they operated and the adversarial tools it was quite clear that this is an iranian campaign trying to make israel look bad and of course ransomware was not ransom was not paid etc

 

 

Highlights :

Attack Details:

  • The attack on Sherbet involved basic hacking methods like web shells and credential harvesting, indicating a lack of sophisticated tools.
  • The attackers utilized simple wipers and custom trojans, along with SSH tunnels and reverse proxies to infiltrate the organization.

Media Exploitation:

  • Black Shadow leveraged Telegram to leak information, causing widespread panic within Israel.
  • The group heavily utilized Israeli media platforms to amplify the impact of the attack, strategically releasing information in stages to create a sense of urgency and scale.

Attribution:

  • The attack was attributed to the Iranian cyber group, Fox Kittens, by cybersecurity experts like Clear Sky.
  • The exploitation of media and the nature of the attack indicated a deliberate attempt by Iran to tarnish Israel's reputation rather than a typical extortion scheme.

 

 

The Black Shadow attack on Sherbet serves as a stark example of how cyber warfare extends beyond technical infiltration. By exploiting media channels, the attackers aimed to magnify the perceived impact of the attack, underscoring the strategic nature of cyber operations in modern geopolitics.

 
 

Speaker:

 

Omri Segev Moyal is a renowned cybersecurity expert known for his expertise in ethical hacking and vulnerability research. With a background in computer science and extensive experience in the cybersecurity industry, Moyal has made significant contributions to enhancing digital security and raising awareness about cyber threats. His work spans across various domains, including penetration testing, malware analysis, and security research, making him a respected figure in the cybersecurity community.

 

https://www.linkedin.com/in/omrimoyal/

https://twitter.com/GelosSnake

 
 
 

 

 

E-mail me when people leave their comments –

You need to be a member of CISO Platform to add comments!

Join CISO Platform

CISO Platform

A global community of 5K+ Senior IT Security executives and 40K+ subscribers with the vision of meaningful collaboration, knowledge, and intelligence sharing to fight the growing cyber security threats.

Join CISO Community Share Your Knowledge (Post A Blog)
 

 

 

City Round Table Meetup - Mumbai, Bangalore, Delhi, Chennai, Pune, Kolkata

  • Description:
    CISO Playbook Round Table Overview : 
    Our round tables are designed to bring together top CISOs and IT leaders in intimate, focused sessions. These closed-door discussions will provide a platform to explore key security challenges and solutions. These sessions aim to create a focused, closed-door environment where 08-10 CISOs will dive deeply into the practicalities of implementing specific technologies.
    • Technology Implementation: From…
  • Created by: Biswajit Banerjee
  • Tags: ciso, playbook, round table

CISO Cocktail Reception At RSAConference USA, San Francisco 2025 !

  • Description:

    We are excited to invite you to the CISO Cocktail Reception if you are there at the RSA Conference USA, San Francisco 2025. It will be hosted aboard a private yacht, so that our CISO's can enjoy the beautiful San Francisco skyline while cruising the Bay Area! This event is organized by EC-Council with CISOPlatform and FireCompass as proud community partners. 

    Yacht Party…

  • Created by: Biswajit Banerjee
  • Tags: ciso, usa, san francisco, rsaconference 2025

Round Table Dubai 2025 | GISEC

  • Description:
    CISO Playbook Round Table Overview : 

    Our round tables are designed to bring together top CISOs and IT leaders in intimate, focused sessions. These closed-door discussions will provide a platform to explore key security challenges and solutions. These sessions aim to create a focused, closed-door environment where 08-10 CISOs will dive deeply into the practicalities of implementing specific technologies.
    • Technology…
  • Created by: Biswajit Banerjee

Fireside Chat With Dan Bowden (Global Business CISO, Marsh McLennan (Marsh, Guy Carpenter, Mercer, Oliver Wyman))

  • Description:

    We’re excited to bring you an insightful fireside chat on "Navigating the Cyber Insurance Landscape: Key Considerations for CISOs" with Dan Bowden (Global Business CISO, Marsh McLennan) and Erik Laird (Vice President - North America, FireCompass). In this fireside chat, we'll decode the complexities of cyber insurance from a CISO’s lens and uncover how to make smarter, security-aligned decisions when it comes to policy design, claims, and ROI.

    As cyberattacks grow in…

  • Created by: Biswajit Banerjee
  • Tags: ciso, cyber insurance, dan bowden